feat(headless): preserve governed tool execution ids

[haasonsaas]

What changed

• adds an optional controller-owned tool_execution_id to headless tool_response messages
• preserves that identifier on externally completed tool lifecycle events
• binds approved native executions to the same identifier until their terminal tool_end
• carries existing governed identifiers through remote-attach approval responses
• keeps existing clients wire-compatible by omitting the field when absent

Why

A platform control plane can allocate a durable ToolExecution record only after Maestro emits a tool intent. Before this change, the controller could approve or complete the tool, but Maestro's terminal event still emitted tool_execution_id: null, breaking durable correlation between runtime events, policy decisions, evidence, and receipts.

This is the first protocol seam for evalops/platform#5204. It intentionally does not add Dex- or channel-specific behavior to Maestro.

Private source-of-truth PR: https://github.com/evalops/maestro-internal/pull/3172

Developer impact

Governed hosted-runner clients may return tool_execution_id with a tool_response. Maestro echoes it on the terminal tool_end. Existing clients require no changes.

Checks

• cargo fmt --all --check
• cargo test -p maestro-tui headless --locked (175 passed)
• cargo clippy -p maestro-tui --all-targets --locked -- -D warnings

Follow-up boundary

Platform will consume this contract from a channel-neutral turn coordinator. Slack, Console Chat, scheduled work, and future channels remain separate projections over the same governed runtime; this PR does not implement that Platform coordinator.

[github-actions]

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Add one of these to the PR body, then re-run the check:

• https://github.com/evalops/maestro-internal/pull/<number>
• evalops/maestro-internal#<number>
• maestro-internal#<number>

Mirrored files touched:

• packages/tui-rs/src/headless/async_transport.rs
• packages/tui-rs/src/headless/messages.rs
• packages/tui-rs/src/headless/messages/tests.rs
• packages/tui-rs/src/headless/transport.rs
• packages/tui-rs/src/headless_server.rs
• packages/tui-rs/src/remote_attach.rs