Add temporary clipboard paste and lifecycle validation

Start with the status block at the top of the issue: persistent text/image/file clipboard work already landed in #122, #135, #139, #142 and #147, so the open scope is only safe temporary paste (including image/file), image export, and lifecycle cleanup on Stop/disconnect/shutdown. Read the closed superseded draft #75 (its 150ms restore must not ship) and the ownership-validation issue #78, then locate Peekaboo's clipboard transaction gate and generation claim plus the existing desktop_clipboard_read/desktop_clipboard_write Bridge operations. Done means native and pi workflows exercise read/write/paste for all three formats with prior contents and newer human changes preserved, and cleanup verified across Stop, client death and graceful shutdown.

Status (Oct 6): persistent text, image and file-reference read/write are complete through #122, #135, #139, #142 and #147 (merge note). Remaining here: safe temporary image/file paste, image export, and the lifecycle (Stop, client death/disconnect, graceful shutdown) and hosted validation below. Draft #75 was closed as superseded; its timed 150 ms restoration must not ship. Unresolved-paste ownership validation is #78.

Complete the clipboard part of #8's input slice through Ace's embedded native bridge, under the channel owner's desktop-tools setting (see #8 and the current architecture).

Progress: Plain-text read/write landed in #122 (2c36c49). Bounded image reads landed in #135 (9c561ba): generation-consistent PNG/JPEG/TIFF previews, explicit orientation/transparency/size metadata, and the existing tool image result. Both have real native and model/durable-reopen proof. Image validation covered ten native cases (including rotation direction, transparent PNG, resizing, white JPEG fallback, absence and bounded refusals), exact persisted text/image results without new calls or usage, and private clipboard restoration with complete owned-runtime cleanup. Persistent text writes use #67’s existing unresolved-paste reservation gate; they do not preserve or restore prior contents. Literal text insertion’s temporary paste already landed in #67. Read-only file-list access landed in #139 (aa48e892): desktop_clipboard_read({format: "files"}) returns at most 32 ordered advertised local file URLs and decoded paths in a complete 24,000-byte JSON result, without opening files, checking existence, canonicalizing paths, or fetching resources. Nine actual native cases and one real model/durable-reopen check passed with private clipboard restoration and full owned-runtime cleanup. macOS filtered three unsupported URL forms before Ace could see them; these correctly returned absent and do not count as native guard coverage. AppKit rejected the legacy-format fixture before a product read, so that guard has source review only. Persistent image writes landed in #142 (a8417c9), validated at exact head 86e0c1e: one bounded execution-host image file, GUI validation, original PNG/JPEG/TIFF bytes and UTI, and the existing unresolved-paste reservation gate. Four exact-byte native cases and nine refusals passed, plus one real Claude Opus 5.5 write/read with distinct-worker durable reopen and one actual delayed-paste reservation refusal followed by admission after the exact receiver exited. All phases restored the original clipboard privately and cleaned every owned runtime. File-reference writes landed in #147 (f24257b). Safe temporary paste (including temporary image/file paste), image export, and the remaining lifecycle/hosted validation below stay open.

Expose explicit clipboard read/write and targeted temporary paste for text, images, and real file URL items. The clipboard belongs to the execution host. Keep clipboard access and the full temporary-paste lifecycle in Ace's long-lived GUI process, where OS clipboard permission applies; a short-lived native client cannot own reliable cleanup after Stop or disconnect.

Reuse Peekaboo's native clipboard transaction gate and generation claim. Capture all prior items/representations within a bounded preservation budget before writing, retain the exact focused-target receipt and snapshot lease, dispatch the guarded paste, and clean up even after caller cancellation. Restore prior contents only when both hold: no paste input was dispatched or meaningful consumption was observed, and the temporary generation is still current. Otherwise keep the replacement and its unresolved ownership (#78); a current generation alone is not enough, because a delayed paste may still be pending. Preserve a newer human update. Report delivery uncertainty and cleanup outcome separately, and verify the resulting target rather than claiming that dispatch proves consumption. A crash/force-kill cannot promise restoration; never restore stale persisted clipboard contents on a later launch.

The typed text clipboard extension added in #122 uses the existing authenticated Bridge transport and operation coordination. Extend that same boundary for images and files. Do not create another clipboard authority, authentication scheme, agent approval, or parallel message/history store. File-content payloads are not file-reference clipboard support: implement real multi-item file URLs. Return bounded text/image previews and file metadata; keep prior clipboard contents out of history unless explicitly read.

Done when real native and pi workflows read/write/copy/paste text, images, and files; temporary paste preserves previous multi-item contents and newer human changes; Stop, client death/disconnect, and graceful Ace shutdown exercise cleanup; local and hosted workspace behavior is verified. Handle native clipboard access refusal through Ace's existing OS permission experience. Keep unverified routes and inevitable cross-process clipboard races explicit.