fix: close v0.3.0 release blockers

[Zesuy]

What changed

• require reanalysis calls and rich image outputs to belong to the same protocol-native terminal tool round
• strictly validate active view_image arguments and protocol-native tool declarations
• hard-bound pending refresh idempotency reservations
• redact URL-, path-, endpoint-, query-, and credential-shaped model labels from public 502 details and ordinary diagnostics
• bind host E2E PIDs to the actual CLIProxyAPI process
• isolate genuine codex exec in a bounded process group so background marketplace children are terminated before cleanup
• correct the v0.3.0 changelog date and document the release boundary

Why

Pre-release live testing and an independent security/compatibility review found cases where historical tool calls could be treated as active refreshes, pending idempotency entries could exceed their nominal bound, configured model labels could leak unsafe values, and E2E cleanup could leave background processes referencing deleted credential-bearing temporary roots.

Validation

• go test -count=1 ./...
• go test -race -count=1 ./...
• go vet ./...
• ./scripts/verify-contracts.sh
• ./scripts/package-smoke.sh
• CLIProxyAPI v7.2.119 host E2E, post-exit process references: 0
• CLIProxyAPI v7.2.121 host E2E, post-exit process references: 0
• real DeepSeek + GPT vision primary path
• genuine Codex view_image rich-tool-output loop
• forced 503 -> attempt-02 fallback with genuine Codex loop
• exact credential scan across repository and temporary files: 0 matches
• final temporary directories/processes: 0
• independent GPT-5.6 Sol review: no remaining P0-P3 findings

Release note

The existing v0.3.0 Draft Release targets the previous main commit. After this PR is merged, rerun the Release workflow for version 0.3.0 and verify the draft target/assets before publishing.