feat: add bounded diagnostics and improve UX feedback

Ask and Execute guidance, Runtime state, live announcements, loading states,
retry paths, settings focus, and update failures now provide consistent and
accessible feedback across the desktop experience.

Add bounded redacted Desktop and Agent diagnostic logs, a read-only Agent
diagnostics command, and an explicit opt-in for attaching a small Desktop
diagnostic summary to in-app feedback. Diagnostics stay local by default and
the existing feedback v1 service contract remains compatible.

Release note: 新增可选桌面诊断反馈与 Agent 诊断导出，并统一 Ask/Execute 状态、错误恢复和无障碍反馈；诊断默认保留在本地，仅在用户明确勾选时附加桌面摘要。

src/agent-daemon/cli.test.ts

@@ -33,6 +33,7 @@ import {
 import { RuntimeBundleRegistry } from './runtime-bundle-registry'
 import type { VerifiedRuntimeBundle } from './runtime-bundle-verifier'
 import type { RemoteRuntimeLock } from '../shared/remote-runtime-launch-contracts'
+import { AgentDiagnosticLog } from './diagnostic-log'
 
 const temporaryPaths: string[] = []
 
@@ -246,6 +247,58 @@ describe('Agent CLI fixed command contract', () => {
     expect(bootstrap).toHaveBeenCalledTimes(2)
   })
 
+  it('exports only bounded diagnostics for a fixed installation ID as JSONL', async () => {
+    const root = privateTemporaryDirectory()
+    const stateDirectory = resolve(root, 'state', 'install-1')
+    mkdirSync(stateDirectory, { recursive: true, mode: 0o700 })
+    if (process.platform !== 'win32') {
+      chmodSync(resolve(root, 'state'), 0o700)
+      chmodSync(stateDirectory, 0o700)
+    }
+    const log = new AgentDiagnosticLog(stateDirectory, {
+      pid: 42
+    })
+    log.record('daemon.ready', {
+      daemonBootId: 'boot-1'
+    })
+    log.record('runtime.start.failed', {
+      runtimeId: 'opencode',
+      error: new Error('private Prompt and /private/path')
+    })
+    await log.flush()
+    const io = cliIo()
+
+    const result = await runAgentCli(
+      ['diagnostics', '--installation-id', 'install-1'],
+      {
+        installationPaths: () => ({
+          executablePath: resolve(root, 'agent', 'goodbuddy-agent'),
+          stateDirectory,
+          socketPath: resolve(root, 'run', 'agent.sock')
+        }),
+        io
+      }
+    )
+
+    expect(result, io.error.read()?.toString()).toBe(0)
+    const output = io.output.read()!.toString()
+    expect(output).not.toContain('private Prompt')
+    expect(output).not.toContain('/private/path')
+    expect(
+      output.trimEnd().split('\n').map((line) => JSON.parse(line))
+    ).toEqual([
+      expect.objectContaining({
+        event: 'daemon.ready',
+        daemonBootId: 'boot-1'
+      }),
+      expect.objectContaining({
+        event: 'runtime.start.failed',
+        runtimeId: 'opencode',
+        error: { name: 'Error' }
+      })
+    ])
+  })
+
   it('dispatches generated attach argv using only derived managed paths', async () => {
     const root = privateTemporaryDirectory()
     const paths: ManagedInstallationPaths = {