refactor(ui-react): split tool activity previews

[Astro-Han]

Summary

• consolidate the small ToolActivity result preview modules into tool-result-preview.tsx, while keeping the larger agent-preview.tsx split out and preserving the public ToolActivity, OverlayHost, and formatBytes exports
• replace the topology/ownership contract with a render-based result preview contract that checks data-kind, visible copy, redaction, truncation, and fallback behavior through OverlayHost
• harden Rive workflow result previews by redacting the final preview body after summary, rows, nodes, errors, and tails are assembled
• route Explore Agent copy actions through generated, pre-redacted copy payloads and cover those payloads with a pure contract test
• loosen the older ExploreAgent source-grep preview test so copy safety is protected by the payload behavior contract instead of helper names or implementation shape
• replace the lazy fallback raw --foreground-50 color with the semantic --muted-foreground alias so the full foreground-tier contract stays green

Scope

Part of #477.

This PR is a structural React/UI ownership split, not a visual redesign. The final shape keeps tool-activity.tsx as the shell, tool-result-preview.tsx as the small result-card owner, agent-preview.tsx as the complex agent result owner, and preview-utils.ts for shared formatting/capping helpers. Existing result-specific contracts still cover web search, Office documents, Rive workflow, terminal truncation, explore agent, and subagent rendering.

The CSS change is intentionally limited to an equivalent semantic-token replacement for .maka-lazy-fallback (--muted-foreground is the 50% foreground alias). It was included because npm run -w @maka/desktop test failed on main with the raw token, blocking full-suite verification.

Verification

• GREEN: npm run -w @maka/desktop test (1830 passed)
• GREEN: npm run -w @maka/desktop build:renderer (passes; existing Vite large chunk warning remains)
• GREEN: npm run -w @maka/desktop build:main && cd apps/desktop && node --test dist/main/__tests__/explore-agent-tool.test.js dist/main/__tests__/tool-activity-result-preview-contract.test.js (20 passed)
• GREEN: npm run -w @maka/ui build && npm run -w @maka/desktop build:main && cd apps/desktop && node --test dist/main/__tests__/tool-activity-result-preview-contract.test.js dist/main/__tests__/explore-agent-tool.test.js dist/main/__tests__/visible-copy-hygiene-contract.test.js
• GREEN: npm run -w @maka/ui build && npm run -w @maka/desktop build:main && cd apps/desktop && node --test dist/main/__tests__/tool-activity-result-preview-contract.test.js dist/main/__tests__/rive-workflow-tool.test.js
• GREEN: npm run -w @maka/desktop build:main && cd apps/desktop && node --test dist/main/__tests__/foreground-tier-contract.test.js

Commit Split

Original split:

• refactor(ui-react): extract tool preview utilities
• refactor(ui-react): extract web and diff previews
• refactor(ui-react): extract office and terminal previews
• refactor(ui-react): extract rive workflow preview
• refactor(ui-react): extract agent result previews
• test(ui-react): lock tool preview ownership
• test(ui-react): route explore preview contract through overlay
• fix(ui-css): use semantic lazy fallback color

Review response:

• refactor(ui-react): consolidate tool result previews
• fix(ui-react): redact rive workflow preview errors
• fix(ui-react): redact rive workflow preview body
• fix(ui-react): redact explore copy payloads
• test(desktop): loosen explore copy contract

[Astro-Han]

Review response pushed in 294725c8 and 8d30e1b5.

• Consolidated the over-split small result preview modules into tool-result-preview.tsx; agent-preview.tsx remains separate because it is the only large/complex preview owner.
• Deleted the topology/ownership contract and replaced it with tool-activity-result-preview-contract.test.ts, which renders OverlayHost and checks user-visible data-kind, copy, redaction, truncation, and fallback behavior.
• Updated existing web/office/rive/explore/subagent/terminal contracts to the new source owner.
• Added a narrow Rive workflow UI redaction hardening for error.reason/message/code/suggestedAction.

Verification:

• npm run -w @maka/desktop test — 1829 passed
• npm run -w @maka/desktop build:renderer — passed, existing Vite chunk warning only

[Astro-Han]

Review response pushed in fe5e3703 and c103f4a1.

• Rive workflow preview now builds the raw preview body first and applies capLines(redactSecrets(body)) once at the final boundary. The contract now seeds secrets in summary, row values, node title/runner, stderr tail, and error message.
• Explore Agent copy actions now use generated pre-redacted copy payloads. The new contract imports buildExploreAgentCopyPayloads, seeds secrets in objective/summary/report/progress/evidence/candidates/matches/continuation inputs, and checks every clipboard payload is redacted.

Verification:

• npm run -w @maka/desktop test — 1830 passed
• npm run -w @maka/desktop build:renderer — passed, existing Vite chunk warning only

[Astro-Han]

Fixed the latest P3 review in 59aeaa8d: removed the duplicate ExploreAgent source-shape copy assertions from explore-agent-tool.test.ts, leaving copy safety covered by the behavior payload contract in tool-activity-result-preview-contract.test.ts.

Verification:

• npm run -w @maka/desktop build:main && cd apps/desktop && node --test dist/main/__tests__/explore-agent-tool.test.js dist/main/__tests__/tool-activity-result-preview-contract.test.js (20 passed)
• npm run -w @maka/desktop test (1830 passed)
• npm run -w @maka/desktop build:renderer (passes; existing Vite large chunk warning remains)