feat(commandbridge): materialize ACP prompt resources

[chicoxyzzy]

Summary

Add a provider-neutral boundary for file and rich ACP prompt inputs in command-backed adapters.

The bridge now:

• validates image, audio, embedded-resource, and local resource-link inputs
• materializes accepted local content in a private prompt-scoped directory
• exposes ordered typed inputs to command builders
• preserves remote resource links as unfetched metadata
• removes the private stage after the turn, including cancellation paths

Safety and privacy

• bounds block counts, individual inputs, and total materialized bytes
• rejects unsupported or ambiguous local paths before launching a provider
• uses private POSIX modes and protected Windows ACLs
• prevents source-local identifiers and stage aliases from leaking through prompts, errors, updates, tool activity, permission requests, or transcripts
• serializes prompt ownership so stale cancellation or cleanup cannot affect a later turn
• fails the prompt if protected cleanup cannot complete, while retaining the guards needed for safe manual recovery

Compatibility

Existing text-only builders remain compatible. Builders that consume prepared rich inputs can use RequirePromptText or PreparedPromptInputs. The exported EmbeddedResource.Kind field makes the first release containing this change v0.2.0.

This branch has been rebased onto current main and preserves the newer native-session failure classification and process-containment behavior.

Verification

• go test ./...
• go vet ./...
• go test -race -timeout 10m ./...
• Windows, Linux, Darwin, and FreeBSD cross-compilation
• Windows cross-vet
• native Darwin ACL and mount checks
• native Windows ACL, reparse-point, restrictive-reader, and exact-cleanup checks
• focused cancellation, UTF-8 boundary, finalization, and cleanup regressions
• go mod tidy
• git diff --check
• exact head under review: e42875248155b041baa7ddf54f16ad196e1f5511