fix(agent): pre-send compaction gate + in-turn recovery for context-window overflow (#193)

[justrach]

What

Fixes #193 — a single turn's tool-output burst could push the request input past the model's context window before auto-compaction ever fired, so codex / gpt-5.x rejected with exceeds the context window and the turn died. That makes graff a poor harness exactly when it's working hardest (many large parallel tool reads in one turn).

Root cause

Auto-compaction was gated on last_context_tokens, which only updates from the server's returned usage — so it lags tool output appended within a turn. The between-turns 80% meter (mainloop.zig) never saw the mid-turn spike. graff already had a local estimator (fullInputEstimateTokens, #174) but only used it to correct the meter after a response, never as a pre-send gate.

Fix (two layers, mirroring codex run_pre_sampling_compact and opencode isOverflow / compactAfterOverflow)

1. Pre-send gate (agent.zig runTurn): estimate the full input locally before every request and compact when it's already ≥ compactAt(), so we never ship an over-cap request. The gate brackets compactOrRecover with closeCodexWs() on both sides — mid-turn the codex WS holds a prev_id / codex_sent_upto watermark keyed to the pre-trim history, so the first reset lets compact()'s own summary request run against a clean session (a stale prev_id makes the server re-prepend the full pre-trim context and defeat/overflow the summary), and the second re-anchors the next in-turn request() to the trimmed full input instead of a delta referencing dropped messages. This matches how every other compactOrRecover call site is bookended by runTurn's closeCodexWs.

2. In-turn recovery (agent_request.zig): the local estimate is a bytes/4 lower bound, so the backend can still reject. On exceeds the context window, emergency-trim and retry the same request once (single-retry guard), then fall through to the original error — the turn recovers invisibly instead of failing.

Verification

• zig build test → 176/176 (adds an inputOverCompactThreshold unit test), zig fmt clean.
• Adversarial multi-agent review of the diff — which caught the missing closeCodexWs bracket above and drove that fix, then confirmed the fixed version correct.
• End-to-end drive against a local mock: a would-be-overflow turn now emits [compacting] → [history compacted] → completes, instead of dying with exceeds the context window.

Known follow-ups (documented on #193, out of scope here)

• Per-tool-output truncation at ingestion (codex TruncationPolicy / opencode max_bytes) — the in-turn recovery is codex/.responses-only; a dense burst on anthropic/openai that both undercounts and overflows still dies as before (same as pre-fix baseline).
• The [compacting ~N tokens…] line reads ~0 when the gate fires off the local estimate (the server meter is still 0). Cosmetic.