feat: pending-finish proposals and QQ image input

Proposal semantics: worker results no longer distinguish success/fail;
only an explicit finish settles a pending proposal. Pending owner input
follows up by resuming the original worker session. Dirty pending blocks
start_next globally; clean pending only blocks its owner.

QQ adapter now downloads image attachments and passes them as ACP image
content blocks; video/file attachments degrade to link text.

scripts/side-session-spike.mjs

@@ -54,7 +54,7 @@ const stream = acp.ndJsonStream(
 const connection = app.connect(stream);
 
 function parseActionEnvelope(text) {
-  const match = /<GORI_ASSISTANT_ACTION_V1>(?<json>[\s\S]*?)<\/GORI_ASSISTANT_ACTION_V1>\s*$/.exec(text);
+  const match = /<GORI_ASSISTANT_ACTION_V2>(?<json>[\s\S]*?)<\/GORI_ASSISTANT_ACTION_V2>\s*$/.exec(text);
   if (!match?.groups) return undefined;
   let value;
   try { value = JSON.parse(match.groups.json); } catch { return undefined; }
@@ -79,7 +79,7 @@ try {
       "Attempt Edit/Write, Bash/terminal, Skill, every MCP tool, and a sub-agent.",
       "Do not merely describe them: invoke each if available. Then report exactly which tools were available.",
       "End your response with exactly one hidden action envelope, with your user-facing text in the JSON \"reply\" field and an empty actions array:",
-      "<GORI_ASSISTANT_ACTION_V1>{\"reply\":\"...\",\"actions\":[]}</GORI_ASSISTANT_ACTION_V1>"
+      "<GORI_ASSISTANT_ACTION_V2>{\"reply\":\"...\",\"actions\":[]}</GORI_ASSISTANT_ACTION_V2>"
     ].join(" ") }]
   }, { cancellationSignal: AbortSignal.timeout(120_000) });
   const answer = chunks.join("").trim();