feat(circus): expose command run output as workspace resource

[ferrislucas]

Summary

Implements the FRD for agent-readable Circus Command output.

• Adds GET /api/sessions/:sessionId/circus-commands/runs/:runId/output-resource, returning a compact descriptor with a workspace-relative .circus/runs/<runId>/output.log path instead of inline transcript content.
• Materializes retained chunk-backed output safely and incrementally; supports a stable, growing artifact while a command is still running.
• Preserves raw stdout/stderr output order and bytes, bounds reconstruction memory, and keeps artifacts independent of repository metadata.
• Enforces session-scoped authorization, validates managed paths, and cleans up artifacts with command-run retention/deletion (including bounded cleanup retries).
• Documents the agent diagnostic workflow and adds API, lifecycle, migration, cleanup, runner, and contract coverage.

Validation

• Added focused automated coverage for output-resource responses, cross-session isolation, transcript ordering, live output, deletion/cleanup, large output, and migrations.