perf: 修复 RingBuffer.tail() 的 O(size) 内存分配问题

tail(N) 原实现通过 snapshot() 先完整拷贝整个有效内容（最多 64MB），
再从末尾切片，导致每次 supervisor 构建上下文时都分配一块大 Buffer。

改为直接从 writePos 往回定位 N 字节的起始位置，只分配 N 字节，
与 replayFrom() 的读取逻辑一致。

Author: pallyoung

packages/server/src/terminal/ring-buffer.ts

@@ -111,18 +111,41 @@ export class RingBuffer {
 
   /**
    * Read the last N bytes currently retained in the buffer.
+   * Reads directly from the circular buffer — O(N), not O(size).
    */
   tail(bytes: number): Buffer {
     if (bytes <= 0) {
       return Buffer.alloc(0)
     }
 
-    const snapshot = this.snapshot()
-    if (snapshot.length <= bytes) {
-      return snapshot
+    const validBytes = Math.min(this.totalBytes, this.size)
+    const bytesToRead = Math.min(bytes, validBytes)
+
+    if (bytesToRead === 0) {
+      return Buffer.alloc(0)
+    }
+
+    let readPos = this.writePos - bytesToRead
+    if (readPos < 0) {
+      readPos += this.size
+    }
+
+    const result = Buffer.allocUnsafe(bytesToRead)
+    let remaining = bytesToRead
+    let offset = 0
+
+    while (remaining > 0) {
+      const availableBytes = this.size - readPos
+      const readLength = Math.min(remaining, availableBytes)
+
+      this.buffer.copy(result, offset, readPos, readPos + readLength)
+
+      readPos = (readPos + readLength) % this.size
+      offset += readLength
+      remaining -= readLength
     }
 
-    return snapshot.subarray(snapshot.length - bytes)
+    return result
   }
 
   /**