feat(tui): add atomic tool output mode

[stevenahhh]

Summary

• add a three-state Ctrl+O tool-output cycle: collapsed, expanded, atomic
• render ordinary atomic tools as adjacent full-width one-line status rows with no left padding
• preserve each atomic spinner's original tool-relative position
• propagate mode changes to direct, nested, and pending tool components
• preserve dedicated and extension-provided renderers outside atomic mode
• bound and sanitize untrusted metadata used by compact rows
• require registered built-in provenance for built-in metadata and passthrough
• suspend hidden renderers and release renderer-owned resources in atomic mode

Contribution process

• proposal: Proposal: add atomic tool output mode #729
• CHANGELOG.md is intentionally unchanged because CONTRIBUTING.md assigns changelog entries to maintainers
• the changelog gate therefore requires a maintainer entry or no-changelog label

Test plan

• changed-domain Vitest: 9 files, 127 tests
• required TUI renderer regression: 62 tests
• root TypeScript and npm run check
• root build
• git diff --check
• native Windows ConPTY smoke: 5/5
• deterministic 80/40-column row capture
• native Ctrl+O cycle and Windows Terminal source launch
• final code-quality and security reviews

Known upstream/environment test failures

On the current a2632b7a base, root npm test stops in test:scripts with
94 pass / 8 fail on Windows/Node 26. The failures are unrelated local-release,
model-generation, and standalone-binary fixtures; this branch's focused tests,
renderer test, static gate, and build pass.

---

Summary by cubic

Adds an atomic tool output mode and makes Ctrl+O cycle collapsed → expanded → atomic. Atomic shows tools as compact one‑line rows, keeps spinner placement (e.g., Bash after name; Eval after target), and restores classic/Grok/self views when you leave it.

• New Features

  • Atomic rows: full-width one‑line per tool with no left padding, bold name, shallow trusted metadata, and original spinner positions.
  • Ctrl+O updates direct, nested, and pending tools; non-tool blocks keep top-level expansion control.
  • Monitor/Todo/Goal keep dedicated renderers; classic, Grok, and extension self-renderers return after atomic.
  • Metadata is bounded and sanitized (strips terminal/Bidi controls; safe-integer counts); only trusted built-ins contribute.
  • Bundled extension entries keep builtin provenance so Eval exposes trusted atomic metadata; tool-call trust is tracked per session and gates built-in renderers/metadata.
  • Keybinding and tips/shortcut overlay updated to describe the three-state cycle.

• Refactors

  • ToolDefinition adds optional disposeRenderState(state) for releasing renderer-owned resources when suspended/hidden or disposed.
  • Built-in Bash implements the hook to stop its elapsed-time interval in atomic mode.
  • Renderer shell suspends hidden views, disposes safely, and only loads built-in definitions when the tool call is trusted.

^{Written for commit 1939739. Summary will update on new commits.}

[stevenahhh]

The Changelog gate is currently the only actionable blocker on this PR. I intentionally left package CHANGELOG.md files untouched because CONTRIBUTING.md explicitly says changelog entries are added by maintainers. The gate supports a no-changelog label, but that label does not currently exist in this repository. Could a maintainer either add the appropriate ## [Unreleased] entry to packages/coding-agent/CHANGELOG.md, or create/apply no-changelog if that is preferred? The relevant nearest changes.md files already document the upstream-tracked core modifications.