Confirm TUI submissions and retain uncertain outcomes

[domsteil]

Commands submitted with n and saved tasks submitted with t now show “Starting” until a receipt and read-only queue inspection confirm the exact job or created plan. The U submissions view retains handles and diagnostics in full and compact terminals. Missing or invalid receipts remain unconfirmed, uncertain work is never retried automatically, and quitting leaves detached helpers and queued work running. Confirmed creation does not imply successful execution.

Each attempt records a private journal, receipt, and CLI transcript capped at 64 KiB. One background inspection batch reads bounded evidence without migrating or recovering the queue. Hidden CLI receipt options retain explicit detached receipts while preserving existing default detached behavior; receipt publication is atomic and refuses to replace an existing file or symlink. Reviewed tasks publish their created plan handle before controller startup, preserving inspection when startup fails.

Validation: 311 focused tests passed through the shared queue with native exit 0, plus formatting and correctness lint. All five CI jobs passed; each direct and queued suite ran 768 tests on Python 3.8 and 3.12. The real PTY check submits one job, reads its handle in U, quits while the job remains running, and then verifies native exit 7 without cancellation. Coverage includes retained plan handles after controller failure, delayed/malformed receipts, filesystem bounds, descriptor cleanup, action isolation, and a stalled-reader exit. Existing cleanup/deadline fixtures now use explicit clock progression and tolerate a process disappearing during a procfs read while preserving their original assertions. Wheel and sdist contents were independently checked against the exact tested source.