feat(message): deliver bounded inbox bodies

[schickling]

Summary

• render one provider-neutral st2.inbox-delivery.v1 FIFO prefix with complete bodies, capped at 16 messages and 16 KiB
• send that view through Codex's existing receipt-bearing app-server path and Claude's SessionStart/UserPromptSubmit additional-context hooks
• add the read-only st2 message delivery view for hook and generic-fallback use
• keep existing reply/archive commands and archive receipts as the only settlement authority
• simplify generated bus guidance to one body-bearing intake plus one grouped action tool call

Why this shape

Issue #238 initially explored a batch settlement protocol. The reproduction and small-state prototype showed that bounded body delivery alone reduces the normal path from two model inferences/four model-tool crossings to one inference/two crossings. A settle/CAS/claim/journal design adds state and operations without improving that metric.

This change therefore adds no claim, lease, cursor, journal, disposition, automatic archive, or new durable state.

Contract and driver boundary

The durable inbox remains authoritative. The renderer selects a complete FIFO prefix; bodies are never truncated. Oversized heads receive an explicit metadata fallback, while overflow and post-batch arrivals remain unread.

The schema, bounds, selection, and tests are provider-neutral. The current Codex and Claude consumers are deliberately thin so issue #162 can transplant them into provider drivers without changing the contract. Unknown/custom providers retain the short metadata DING.

This PR is stacked on #237 at exact base 1d06c4b263a7c5a2a6b8eec1f2e8c4fbea5e2edc and reuses that typed Codex delivery receipt. It does not duplicate the Claude channel work in #232.

End-to-end provider evidence

Companion eval PR: compoundingtech/evals#74 at exact head 0e6b64ebdc652687926d43f4a41a955831ddd846.

Tracked receipt: https://github.com/compoundingtech/evals/blob/0e6b64ebdc652687926d43f4a41a955831ddd846/evidence/inbox-one-turn-provider-ab-runs-20260811.json

metric	#237 baseline	#239 candidate	change
held-out functional score	FAIL, 3/4	PASS, 4/4	exact-body outcome fixed
Codex total tokens	535,286	227,871	-57.43%
Codex model-response events	17	7	-58.82%
Codex tool-call boundaries	11	4	-63.64%
Codex wall time	115.367 s	45.676 s	-60.41%
Claude token volume	367,011	319,857	-12.85%
Claude session duration	114.706 s	45.315 s	-60.49%

The baseline was body-blind: Claude explicitly discovered bodies, while Codex archived all messages but could only acknowledge subject-derived summaries. The candidate replied on and archived every hidden exact body, including a bounded burst and post-batch arrival.

The original provider executions completed but their judge launcher exited 127 due a cell-relative path. The eval receipt preserves that no-verdict axis and records deterministic RED/GREEN regrades of both preserved catalogs with the corrected graders; it does not relabel the original judge invocation as green.

Verification

At exact head c1a0f90dd4814ec3ce8067219530d7bd8723e191:

• CI check: PASS (293 workspace library tests plus repository gates)
• cargo test --test invariants: 1 passed
• cargo test --test hooks --test codex_app_server: 14 passed
• cargo test --test claude_hooks --test message_cli: 14 passed
• cargo test --test native_only clean_path_executes_the_maintained_native_authoring_guide: passed
• focused Codex app-server tests: 22 passed, including archived-prefix release of overflow/post-batch arrivals
• git diff --check

Strict Clippy reaches eight pre-existing warnings in unchanged files (too_many_arguments, needless_borrow, and let_and_return); no changed-file lint was reported before that baseline failure. Two unrelated native_only cases are environment/baseline red because /bin/sleep is absent and current docs/vrs/spec.md already contains the retired-name scan token; the changed native materialization case passes.

Documentation authority

The active spec records the bounded view. Protected root docs/vrs/requirements.md is intentionally unchanged pending Nathan's explicit approval.

Closes #238 when the stack is accepted. This PR remains draft pending review; do not merge or deploy from a focused branch.