feat: spill oversized tool outputs to a spill tape

[PsiACE]

Closes #249

What's going on

A huge tool result — say grep -R over node_modules with one very long line — was being re-sent in full on every later model request. Make it big enough and the provider answers 413 Request Entity Too Large; the whole turn dies.

The approach

Stop putting big outputs into the model request. Write them once, keep them around, and hand the model a pointer.

1. Spill — tool results over BUB_TOOL_SPILL_THRESHOLD (default 4096 estimated tokens, ~4 chars/token) are written once to a spill tape, in the same store as the session tapes. The session tape keeps a small ref instead: handle + shape + a head/tail preview.
2. Read back — a read_tool_result tool reads slices of a spilled payload on demand (offset / limit / from_end / literal pattern), capped at 1000 lines / 50k chars. Its own results never spill.
3. Last-resort cap — BUB_MAX_REQUEST_BYTES (default 256 KB) clamps any oversized tool message before it reaches the provider, so even a plugin that bypasses spilling can't send an unbounded body.
4. No cleanup — the spill tape is shared across sessions and has no TTL or pruning. Retention is the user's call, same as the session tapes: delete it when done.

Errors are never spilled — the model needs the full error text to recover. If writing a spill fails, the original result is used; a spill problem never fails a turn.

How it fits

• ToolExecutor rewrites oversized string results after the after_tool_call observers, so tracing still sees the original; only what lands in the tape and the model request gets smaller.
• Spill entries bypass the session-tape fork and land in the shared spill tape immediately, so they survive merge-back and stay readable across turns and sessions.
• It reuses the tape store end to end: no new storage, no sidecar files, no new hooks.

Settings

Env	Default	Meaning
BUB_TOOL_SPILL_THRESHOLD	4096	estimated tokens above which a tool result is spilled; 0 disables
BUB_MAX_REQUEST_BYTES	262144	hard cap on the serialized request body; 0 disables

Verification

• uv run pytest -q — 282 passed
• uv run ruff check src tests — clean
• uv run mypy src — clean
• tests/test_spill.py — 13 behavior/regression tests: spill + read-back roundtrip, small refs, small results and errors untouched, write-failure degrade, fork passthrough, read bounds and literal pattern, unknown handle, the 413 scenario (the next request never carries the payload), and the hard-cap clamp.

[PsiACE]

Rebased onto main (now includes merged #273 fix/unknown-tool-recovery). Re-ran the full suite:\n\n- uv run pytest -q — 287 passed\n- uv run ruff check src tests — clean\n- uv run mypy src — clean\n\nNo conflicts; the unknown-tool placeholder and the spill path compose cleanly (placeholder errors are never spilled, small refs stay intact).