Remove the goal subsystem

[TheGreatAxios]

Summary

• Deletes the goal subsystem entirely per operator decision ("too complex, we need to rescope it"): src/agent/goal.ts, goal-evaluator.ts, manage-goal.ts, session/goal-state.ts, permission/goal-approval-timeout.ts, and their tests (~2,500 lines including tests).
• Unwinds every consumer: the /goal slash command, director's goal-rewrite branch, tool advertisement gating (manage_goal, hasGoalAtLaunch), TUI chrome zone/palette toggle/geometry budget entry, compaction summary context, and the goal-specific arming condition on the permission-gate auto-deny timeout.
• Kept: manage_tasks (unrelated work-list tool), and the generic approval-timeout plumbing in gate-events.ts / request-approval.ts — only the goal-specific arming condition was removed. That plumbing now has zero callers; documented explicitly rather than silently dropped or given an invented caller.
• docs/ARCHITECTURE.md documents the interceptTerminal contract (inputs, return convention, precedence, compaction-survival requirement, token attribution, launch-ordering constraint) as the specification for the director-based replacement of the continuation capability the goal governor provided.
• Added a regression test confirming a leftover goal.json from a pre-removal session dir doesn't break session listing (dropped on read, never fatal).
• Net: 52 files changed, +160/-3340.

Rebase onto main (#407 and others merged mid-review)

This branch was rebased onto current origin/main after #407 (CL-5664: queued-gate timers arm at display not emit, onOperator gained an abort/timeout safety net, a shared attachApprovalBudget helper landed in request-approval.ts, operator-gate teardowns are now tracked and drained on dispose) merged, along with several other same-day PRs. Two real conflicts, both in the timeout-arming plumbing this branch touches:

• src/tui/request-approval.ts — composed the new attachApprovalBudget helper (from Arm queued gates' display-dependent timers only once shown #407) with this branch's goalTimeout → approvalTimeout rename. Resolved by keeping Arm queued gates' display-dependent timers only once shown #407's helper and calling args.approvalTimeout() instead of the old args.goalTimeout().
• src/tui/runner.ts — Arm queued gates' display-dependent timers only once shown #407 turned out to have built a shared goalTimeout() closure used at three call sites, not one: the permission gate, onOperatorGate, and requestMcpTrust (TOFU). My original diff only touched the permission-gate call site because that's all that existed when this branch was cut. Resolved by generalizing the shared closure itself to approvalTimeout: () => undefined and updating all three call sites to use it, so the "no caller arms this, plumbing kept for a future generalized mechanism" story holds consistently everywhere, not just where I originally happened to look.

A third, non-conflicting but real issue: gate-wire.ts's rewrite from #407 added two new comments ("goal-mode timeout", "the goal-mode timeout") and gate-wire.test.ts added a new timeout fixture string ("goal mode: no answer in time") for the new onOperator timeout test — none of these existed when this branch was cut, so the rebase silently reintroduced stale wording that a plain conflict-resolution pass wouldn't have caught. Fixed by wording only (no logic touched) in a dedicated follow-up commit.

Invariant re-verification against the new base (not assumed to carry over)

• CL-5644 / CL-4995 (every gate settles exactly once, one transcript row) — gate-wire.ts's settle-once architecture (the permission queue as the single settle guard, openedGeneration vs overlayGeneration for the operator gate, recordDecision as the sole transcript-row writer) is structurally unchanged by this branch; my edits there are two comment lines. Read the full onPermission/onOperator bodies post-rebase to confirm no dangling reference to the deleted timeout source disturbs settlement.
• CL-5664 (timers arm at display not emit; onOperator abort/timeout/auto-cancel; teardown drains on dispose) — this is the invariant most directly under my feet, since I generalized the exact closure Arm queued gates' display-dependent timers only once shown #407 built this feature on top of. Verified: approvalTimeout() now returns undefined unconditionally at all three call sites (permission gate, onOperatorGate, requestMcpTrust), so the display-gated arm-on-open logic in gate-wire.ts simply never receives a timeoutMs to schedule — it degrades to "abort-only" safety net exactly as intended, not silently broken. operatorTeardowns drain-on-dispose is untouched code.
• CL-5641 / CL-5642 (stall exemption: tool calls outstanding OR gate open) — turn-state.ts diff against the new base is still comment-only.
• CL-5646 (agents panel degrades one row at a time; budgets measured not guessed) — re-checked geometry/zones.ts/geometry/resolve.ts/shell.ts diffs against the new base: identical shape to the pre-rebase diff (goal dropped from ZONE_IDS/ZONE_REGISTRY/COLLAPSE_ORDER/PAINT_ORDER/ZoneVisibility, promptTop arithmetic dropped only goalH). No other zone changed today collided with this.

Capability lost, replacement needed

Deciding whether to re-enter inference after a clean yield (wait/reply → infer rewrite) is no longer implemented anywhere — it moves to the director later, generalized beyond a single-goal acceptance checklist. See docs/ARCHITECTURE.md's "Removed: goal subsystem" section for the full contract, including the compaction-survival trap (continuation state living only in turn history dies at the first compaction) that the deleted SummaryContext.goal field existed specifically to avoid.

The approval-timeout auto-deny/auto-cancel mechanism (timeoutMs/timeoutMessage) is kept but currently has no caller at any of its three sites (permission gate, operator gate, MCP TOFU) — a future generalized auto-continue mechanism owns re-arming approvalTimeout() in runner.ts.

Test plan

• bun run typecheck — clean (post-rebase)
• bun run build — clean (post-rebase)
• bun run test — 4131 pass, 0 fail (post-rebase; main gained tests via Arm queued gates' display-dependent timers only once shown #407 and others since this branch was cut, so this number is not directly comparable to the earlier 4122/0)
• Regression test for stale goal.json session-dir compatibility
• Five-reviewer bar (greybeard, CTO, critique, neckbeard, karen) — findings addressed; do not merge, read-first gate per operator