fix: 修复内存溢出问题，compact 时清理持久增长数据结构

- compact 时清理 contentReplacementState（seenIds/replacements）
- logError() 使用 shortErrorStack 替代完整 err.stack，减少 GC 压力
- permissionDenials 每次 submitMessage 清空，防止无限增长
- SSE 缓冲区添加 1MB 上限，防止畸形数据无限累积

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/cli/transports/SSETransport.ts

@@ -350,6 +350,7 @@ export class SSETransport implements Transport {
     const reader = body.getReader()
     const decoder = new TextDecoder()
     let buffer = ''
+    const MAX_BUFFER_BYTES = 1024 * 1024 // 1MB — SSE frames include event/data/id prefixes
 
     try {
       while (true) {
@@ -357,6 +358,14 @@ export class SSETransport implements Transport {
         if (done) break
 
         buffer += decoder.decode(value, STREAM_DECODE_OPTS)
+        if (buffer.length > MAX_BUFFER_BYTES) {
+          logForDebugging(
+            `SSETransport: Buffer exceeded ${MAX_BUFFER_BYTES} bytes — dropping connection`,
+            { level: 'error' },
+          )
+          logForDiagnosticsNoPII('error', 'cli_sse_buffer_overflow')
+          break
+        }
         const { frames, remaining } = parseSSEFrames(buffer)
         buffer = remaining