feat(engine): add tool-result clearing and approval pause timing

[Patel230]

Summary

Adopts two novel, self-contained mechanisms from the herm coding agent (github.com/aduermael/herm), ported to hawk's message/permission models with full tests.

1. Two-tier tool-result clearing (internal/engine/compact_clear.go)

• Port of herm's clearOldToolResults: at 80% of the context window, replace the content of old tool results with [output cleared] placeholders — biggest-first, keeping the most-recent clearKeepRecent (4) tool-result messages intact, and stopping once token usage drops below the threshold.
• The tool_use blocks are left untouched, so the model still knows what was called and can re-read files on demand. This is a gentler tier below compaction (which fires at a higher watermark).
• Wired into ManageContextBeforeTurn as the first context-reclaim step: clear (0.8) before compact.
• Operates on a clone — the persisted original is never mutated in place.

2. Approval pause-timing telemetry (internal/permissions/approval_workflow.go)

• Port of herm's approval pause tracking: ApprovalRequest now records DecisionAt (timestamp) and PauseDuration (human deliberation time, DecisionAt - CreatedAt) when a request is approved or denied, for approval-latency observability.

Verification

• New tests: TestClearOldToolResultsNoOpWhenBelowThreshold, TestClearOldToolResultsClearsBiggestFirst, TestClearOldToolResultsStopsWhenUnderThreshold, TestClearOldToolResultsSkipsAlreadyCleared, TestApprovalRecordsPauseDuration
• go build ./..., go vet, full engine + permissions suites green
• Boundary guard + govulncheck + full pre-push test suite green

(Follow-ups for future PRs: herm's provider-response replay cache, graceful turn-budget exhaustion synthesis, staged skills mount.)