fix(journal): keep prose whole on write, lead with open threads on read

[laynepenney]

Ref #997 — closes at promotion

What this fixes

Two defects in the session journal, unrelated in code and identical in character: both fail toward
looking fine.

Write — the three journal fields were each split on ;, so a semicolon used as ordinary
punctuation fragmented a sentence and stripped its subject. Measured on a real entry: one field
produced seven items, six beginning mid-sentence, one reading in full as the fix is 4d11834e. The
result reads as terse notes rather than as damage, which is why it survived.

Read — format_for_session_start is bounded, and it led with Done. Completed work consumed
the window before open threads were reached. Ordering is taste on an unbounded surface and correctness
on a truncated one.

The change

Splitting prefers newlines and falls back to semicolons only when the text has none — how the fields
are actually written, one item per line — so every existing single-line caller works unchanged and
--done "a; b; c" behaves exactly as before. A single-line field containing prose semicolons is still
ambiguous by construction; the fallback preserves the documented CLI convention, and that trade is
deliberate.

The split existed in six places across two modules, which is its own latent defect: fixing one path
would have left the other mangling prose. It is now one function called from both.

Open threads now lead the bounded read. The unbounded display is reordered to match — nothing forces it
there, but two surfaces that teach different priorities are their own defect, and a human reading a
full entry also reads top-down and stops.

Witnesses

Both assert what the reader receives, not what was written. That distinction is the whole finding:
asserting the written value passes in both the fixed and broken states, which is how two defects
reached a green suite with no test on either behaviour.

Witness	Killed by
prose with a semicolon reaches the reader whole	restoring the semicolon-only split
open threads precede completed work in the bounded read	reversing the ordering tuple

Each mutation kills exactly one witness. The ordering witness also asserts both sections are
present, so it cannot pass by one of them simply being absent. A control witness pins the single-line
semicolon behaviour that existing callers depend on.

Test suite

	passed	failed
base	2662	4
head	2666	4

Delta +4, exactly the four tests added here. The four failures are identical on both sides, live in a
module this change does not touch, and are reported so they are not mistaken for regressions.

Premium boundary

recall is OSS: local journal storage and formatting. No identity, org, or entitlement behaviour.