Recover concrete action promises without tool calls (#989)

[lihongguang-0014]

Scope

Fix #989 by reusing the existing bounded text-only recovery loop when a tool-capable model explicitly promises a concrete next action but emits no tool call.

• Enable the existing warn_model recovery mode by default while preserving the explicit off compatibility setting.
• Recognize narrow English and Chinese first-person/temporal action promises, including the reported Manager Server wording.
• Allow the bounded recovery after earlier tool results, which is where the reported premature stop occurs.
• Keep completed reports and negated actions terminal.

This rebuild removes the previous action-completion protocol, complete_action_task tool, shell grammar, global tool side-effect inventory, new terminal type, persistence changes, channel changes, and Web changes. Recovery remains limited to two model nudges and never replays a tool call.

Compatibility and Upgrade

No wire, database, persisted-session, Web, desktop, or tool contract changes are required. Existing configurations that set text_only_tool_recovery_mode=off retain the old stop-on-text behavior. The detector intentionally covers concrete English and Chinese action promises rather than claiming a universal task-completion proof.

The synthetic upgrade rehearsal test allows 30 seconds on Windows and 15 seconds elsewhere. This only accounts for hosted Windows process startup variance; updater runtime behavior is unchanged.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: Fixes #989

Release Note

Release note: Tool-capable turns recover when the model promises a concrete next action without making the tool call.

Tests

• 88 affected engine, runtime-event, legacy-config, canonical-text, and upgrade-baseline tests passed.
• 33 RPC and architecture contract tests passed.
• The eight rehearsal-driver tests passed locally. The Windows-specific timeout branch could not be executed on this macOS host; the failing queue logs exercised the same helper on Windows and timed out at the former 15-second boundary.
• Targeted Ruff and mypy passed; git diff --check passed.

No live provider or browser run was performed.

Maintainer Live Check

Maintainer live check: no

Surface: engine

Safety

No secrets, local paths, private prompts/transcripts, channel identifiers, or private fixtures are included.

Third-Party Origin

Third-party origin: none

Details if non-none: N/A.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.