feat(record): run recording groundwork (bundle, HTTP cursor, redaction, viewer, step times)

[pbertsch]

Summary

• Adds the groundwork for run recording in internal/record:
  • a bundle writer (manifest, timeline, exchanges, widget trees, screenshots) with validated names and atomic 0600 writes;
  • an HTTP log cursor that waits for requests still in flight and counts exchanges the agent's ring evicted;
  • redaction for headers, URLs and bodies, including numeric card numbers and PINs;
  • an offline viewer that renders a bundle without a server. Bundle values go in as text only, and a content security policy blocks network requests.
• Adds StepEvent.At, the wall-clock time each step event was emitted.
• No command or agent behaviour changes. Nothing is recorded yet: the runner hook and probe test --record come in a follow-up PR.
• Screenshot blackout will reuse internal/redact, which this PR does not change.
• The CHANGELOG links to the design doc in docs: run recording PRD (design only, no behaviour change) #469. Merge docs: run recording PRD (design only, no behaviour change) #469 first so that link resolves.

One existing expectation changed: redact_test.go used to expect "token": 123 to stay unredacted. It now expects "<redacted>", because numeric tokens, PINs and card numbers are credentials.

Test plan

• go test ./... passes on the root module
• go build ./... passes
• gofmt -l is clean for internal/record and the two changed runner files
• go vet ./internal/record/ ./internal/runner/ is clean
• Open internal/record/viewer/index.html in a browser against a real bundle: check the layout at phone width and in dark mode, and the screenshot paths
• CI passes, including the disclosure guard

gofmt -l internal/runner lists seven files that were already unformatted on main (ai_text_test.go, executor_ai_test.go, http_steps.go, http_steps_test.go, reporter.go, runner.go, runner_test.go). This PR does not touch them.

🤖 Generated with Claude Code

[pbertsch]

Browser check of the offline viewer, against a generated sample bundle served from loopback, at desktop width in light mode:

• Steps list with status badges, before and after screenshots, the interaction target, and the widget tree all render.
• Request and response bodies show <redacted> where credentials were.
• A failed step shows its error, its 500 response and its widget tree.
• No console errors on load.

Not verified: phone width and dark mode. The browser tool could not resize the window, and the viewer's Content-Security-Policy blocks framing, so the page cannot be checked inside an iframe.

Found and fixed in c0f4b11: a page built from the timeline alone showed exchange IDs and no widget trees. WriteViewer now inlines them.

Follow-up: an empty request body renders as a blank block rather than a label.

🤖 Generated with Claude Code