fix(claude-sdk-oauth): ignore volatile thinking timing

[goldtg]

Why

Claude SDK OAuth captures the provider-final assistant message during the last
message_update, before agent-core adds display-only startedAt and endedAt
fields to thinking blocks. Comparing that capture with the committed
message_end content therefore classified otherwise identical turns as
assistant_rewritten.

That false divergence abandoned resident-session continuity and repeatedly
re-sent the growing conversation history, increasing cache writes and eventually
exposing the replay buffer limit reported in #691.

What

• exclude only thinking-block startedAt and endedAt fields from the
  commit-boundary digest
• preserve thinking text, signatures, tool calls, text, provider identity, and
  all other semantic content in rewrite detection
• add a deterministic 10-turn issue regression covering timing-only enrichment,
  non-mutation, thinking rewrites, and text rewrites
• document the provider-specific behavior and merge-conflict surface

Verification

• npm --prefix packages/coding-agent test -- test/suite/regressions/691-claude-sdk-oauth-thinking-timing.test.ts
• Claude SDK OAuth owning suite: 39 files, 324 passed, 3 skipped
• npm run check
• npm run build
• Senpi CLI smoke: 8/8
• zero-token Anthropic mock loop: 20/20
• built-module driver: 10/10 timing-enriched turns remained clean; semantic
  rewrites remained rewritten

Fixes #691

---

Summary by cubic

Prevents false assistant rewrites in the claude-sdk-oauth provider by ignoring non-semantic startedAt/endedAt fields in thinking blocks during commit-boundary hashing. Restores session continuity to avoid history replays and cache churn (fixes #691).

• Bug Fixes
  • Exclude only startedAt/endedAt in thinking blocks from the continuity hash; keep all semantic fields.
  • Maintain rewrite detection for real changes (thinking text, signatures, tool calls, text).
  • Add a deterministic regression test covering timing-only enrichment and true rewrites.

^{Written for commit 14cef47. Summary will update on new commits.}

[goldtg]

Hi @code-yeongyu — the CI and Changelog gate workflow runs are currently action_required because this is a first-time fork contribution. Could you approve the workflow runs when convenient?

Per CONTRIBUTING.md, I left package CHANGELOG.md maintainer-owned and added the required provider-local changes.md entry. Local verification is listed in the PR body; no real provider calls were used.