fix: keep oversized tool results out of model context

[naliazheli]

Restores #553. GitHub automatically closed the original PR when its source fork was temporarily made private. This replacement preserves the original change.

Problem

TurnEngine currently serializes every successful tool result directly into model history. A single large browser/computer snapshot, MCP response, database result, or log can therefore consume the remaining context window before compaction gets a chance to run. In a reproduced case, one snapshot returned more than 100k characters and the next provider request failed.

This is a runtime boundary problem rather than a computer-use-specific problem: every registered tool currently reaches the same unbounded _tool_result_message path.

Changes

• add a global result projection step at TurnEngine._record_result
• keep results up to 40k characters inline and unchanged
• retain larger results under the workspace-private .openworker/tool-results/ directory
• send the model a bounded head/tail preview plus result_ref, size, and SHA-256
• add low-risk read_tool_result for exact, paged retrieval
• constrain retrieval to the retained-output directory, validate UTF-8 page boundaries, and size the serialized page so retrieval cannot recursively spill again
• cap retention at 64 MiB per result and 512 MiB per workspace
• invalidate the previous provider token count after every tool result so the next compaction checkpoint estimates the newly appended context

Small tool results preserve their current shape and behavior.

Relationship to #67

#67 addresses the same core problem and includes a broader session-scoped design, including shell capture, server/UI retrieval, ACL handling, and lifecycle cleanup. At the time of this PR it is 288 commits behind main and has merge conflicts.

This PR is intentionally a smaller current-main implementation focused on protecting the model context for all ordinary tool results. I am happy for maintainers to prefer a refreshed #67 or combine the approaches; this PR explicitly credits that prior work and does not claim its broader scope.

Validation

• focused engine/tool-result suite: 45 passed
• full backend suite: 1864 passed, 1 skipped
• 3 URL-address-guard tests fail because this machine resolves example.com and short.link to the 198.18.0.0/15 private benchmark range; the same 3 failures reproduce unchanged on origin/main@7fc3ee6

No frontend code is changed.