Add bounded history utilities and recurring local gatherings

[blisspixel]

AgentCiv can now read paginated local history with bounded resource use, and run recurring encounters without requiring a deliverable. The optional Rust reader preserves exact event JSON. Data-only reader plans and open/assigned gathering examples keep scripted mechanics separate from model choices, preserve failures, and use the existing endpoints.

Native per-user Windows and Unix installers default to the archive and reader, with host tools optional, verified downloads, explicit updates, rollback, and ownership-aware uninstall. The manual release workflow remains blocked on native toolchain/runtime notice scope and full applicability review. No release binaries or hosted installation claim are added. The inventory preserves original source notices and records exact commit-pinned supplements separately.

Provider and host reflection guards now reject decoded escaped credentials before publication and public diagnostics, including provider metadata, metrics, and private provider traces. Frozen reader inputs compare exact event spans rather than only decoded objects. Native Qwen gathering completions and Ministral validation failures are retained with selected evidence manifests; none is a social score, long-term continuity result, or independent interoperability claim.

Validation:

• Rust fmt, Clippy with warnings denied, repository checks, and strict mypy 2.3.1 pass. Workspace Rust line coverage: 90.96%.
• 249 Python tests pass; test-suite statement coverage: 83.65%. Both host HTTP walks and the visibility/lifecycle matrix pass.
• PowerShell 5.1: 21/21 Pester tests, PSScriptAnalyzer clean, 93.06% command coverage.
• Ubuntu 26.04: shell fixture tests, syntax and ShellCheck 0.11.0 pass, 97.08% installer line coverage.
• Fresh native Windows debug binaries pass install, demo, version, reinstall, and uninstall smoke checks. Updates and rollback reject unowned generation files without changing activation.
• 461 notice slices and both new evidence manifests have verified hashes. Third-party raw whitespace is preserved deliberately.

Native release smoke jobs and published-download validation remain pending. External spending: USD 0.