Task lifecycle hardening: bounded model fetch, cancellation-safe condensation, durable history ordering

[DaubnerF]

Split out of #1505 during review so that PR stays focused on the prompt/tool-policy fixes for #1240 and #505.

The work covers six things on the task path:

• The model-metadata fetch on the task paths is bounded by a 5 s timeout; a stalled provider fetch previously hung prompt building and condensing indefinitely, and now falls back to the same fallback metadata a rejected fetch already produced.
• Abort-signal plumbing lets a timed-out or abandoned metadata wait detach from the shared in-flight fetch. An open question the review raised: reference-count the shared fetch so the underlying request aborts when the last waiter cancels.
• Completion-time history save ordering, pinned by unit tests: the durable history write is awaited before completion.
• The restart-persistence e2e polls for the conversation-history file, tolerating the swap window of main's atomic-rename writes.
• Context-window overflow recovery reuses the request's model-metadata snapshot instead of re-fetching, so a metadata update landing between the failed attempt and recovery can no longer over-truncate history.
• Manual condensation rechecks cancellation after the metadata fetch, after the system prompt build, and after the summarization call, so a cancelled task can neither start a summarization request nor overwrite the persisted conversation history; deterministic regression tests cover each window.

All of it is implemented, tested, and passing. It is preserved as git patches plus a hunk-level inventory, so adopting it means re-applying those changes in a standalone PR with its own scope, not rewriting from scratch.