Stacks on the compaction-rework change (merged as #597). Adds a
`WorkingContext` field to `SessionState` that tracks recent files the
agent has read/written/edited, survives compaction, actor recovery,
and daemon restart without depending on the observer LLM to
reconstruct it.

This introduces a new tier of session state that sits parallel to
existing tiers:

- Skills: stateless how-to reference (already exists)
- Memory: cross-session facts (already exists, via memory store)
- WorkingContext: in-session mutable state (new)
- Conversation: turn history (already exists)

`WorkingContext` carries a single field: `RecentFiles` — a bounded
ring buffer of 10 file paths, most-recent-first, deduped on repeat
access. Updated automatically by `LlmSessionActor` when a path-taking
tool (file_read, file_write, file_edit, etc.) completes. The path is
extracted from the tool call's `ArgumentsJson` via
`WorkingContextUpdater.TryExtractFilePath` which probes well-known
JSON field names (`path`, `file_path`, `filePath`, `file`, `filename`,
`fileName`) — no tool-name allowlist, so first-party tools and MCP
filesystem tools participate automatically.

Security: `AddRecentFile` rejects paths containing control characters
(newline, carriage return, null byte). Without this, an attacker-
crafted path containing a literal newline would break out of the
`recent_files:` section in the `[working-context]` block and inject
arbitrary content into the LLM's system prompt. Rejected paths are
silently dropped at the earliest point in the ingestion pipeline.

Injection: `WorkingContext` is emitted as a `[working-context]` block
via `InjectDynamicContextLayers` on every LLM call when non-empty,
adjacent to the existing `[session]` block. Suppressed entirely when
`WorkingContext.IsEmpty` so the model doesn't see a barren header.

Explicitly NOT in this change:
- OpenGoals / ProgressMarkers fields and the observer-output parser
  that would populate them — deferred per "no hypothetical future
  requirements" rule. Can be added in a follow-up change when the
  parser lands.
- CurrentWorkingDirectory / ActiveProjectPath — GitHub #595.
- Authoritative CWD for path-taking tools — GitHub #596.

Journal compatibility: `WorkingContext` is a new optional field on
`SessionSnapshot` (ProtoMember 6) and `SessionCompacted` (ProtoMember
7). ProtoMember 5/6 respectively are reserved holes — formerly
`CompactionBoundaryIndex`, removed before compaction-rework merged.
Old snapshots and events without the field deserialize to
`WorkingContext.Empty` via `SessionState.FromSnapshot` /
`Apply(SessionCompacted)`.

Precedent: Cline's `TaskState.currentFocusChainChecklist` in
`src/core/task/focus-chain/` is the closest comparable pattern — a
persistent markdown todo list tracked on disk, re-attached to every
LLM call, explicitly protected from re-summarization. `WorkingContext`
is the Netclaw equivalent, stored on `SessionState` rather than a
standalone file.

Tests: 933/933 pass (+11 new). Slopwatch clean (SW003 on the
JsonException catch is explicitly ignored via inline directive with
justification — LLM-generated tool args can be malformed and "no
path tracked" is the correct handling).

Refs Aaronontheweb/netclaw#595, Aaronontheweb/netclaw#596

…for WorkingContext

WorkingContextUpdater now takes an optional ILoggingAdapter and emits debug
logs for both tracked files and schema-drift (tool call had string-valued
arguments but none of the probed field names matched). Operators hunting
"why isn't this file in [working-context]" get a concrete signal in debug
logs.

Adds an end-to-end integration test that drives a file_read tool call
through the real compaction pipeline (3 turns: populate → compact → probe)
and verifies the [working-context] block still contains src/Rect.cs after
compaction. This exercises WorkingContextUpdater, the SessionCompacted
event path, and InjectDynamicContextLayers together — not just direct
Apply() on an in-memory state.

Refs #600 (sub-agent gap discovered during this work).