fix: bound Antigravity replay retention

[Ingwannu]

Summary

• replace raw model/session/function-argument cache keys with fixed-size SHA-256 identities
• cap replay at 64 KiB per signature, 256 calls and 2 MiB per session, and 32 MiB globally
• use call/session LRU eviction while keeping the existing one-hour TTL semantics
• preserve prior valid mappings when an oversized replacement is ignored
• sweep expired sessions at most once per minute outside budget pressure

Part of #820. This intentionally isolates the reproduced Antigravity retention problem from #829 app-wide memory infrastructure.

Verification

• bun test tests/google-antigravity-replay.test.ts tests/google-antigravity-wire.test.ts (56 pass)
• bun run typecheck
• bun run privacy:scan

Compatibility

Normal sequential tool loops keep the newest 256 signed calls. In an extreme longer loop, an evicted old call may receive the existing upstream signature error rather than remaining in memory without a bound.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f3f1b482-92dc-4dd9-b6d9-99709a411a24

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}