Validate history-compact checkpoint summaries at load time (repair poisoned sessions)

Background

#3029 added validation at the two checkpoint write gates: a malformed/truncated LLM summary can no longer replace folded history going forward. The fix is write-only.

Gap

A checkpoint whose summary was persisted before the gate (e.g. the incident checkpoint hcheckpoint-981ceab8… in session fbdb3fd3) still loads and replays: loadLatestHistoryCompactCheckpointFromRunLedger only checks validateHistoryCompactCheckpointShape (non-empty summary), not the summary contract. The already-poisoned session keeps serving the fragment until a later successful fold happens to supersede it.

Why not just reuse the same validator

Load-time validation is asymmetric to write-time: at write time the summary was just produced by the sectioned summarizer prompt, so a missing ## Goal heading means degraded output. At load time the ledger may contain checkpoints written by older binaries whose summaries never followed the sectioned contract but are still usable. Applying validateHistoryCompactSummary verbatim would silently discard those and force a fallback to raw events (safe but wasteful/surprising), or loop re-compaction.

Suggested direction

• Only validate checkpoints whose shape/metadata indicates the sectioned writer (e.g. a schema version bump or an explicit summaryFormat field), leaving legacy checkpoints to the existing shape check.
• Or validate but treat "section-less yet non-trivially-long" as a distinct case from "fragment/truncated" and migrate rather than discard.
• Add load-path tests mirroring the existing history-compact-checkpoint.test.ts fixtures (which currently use section-less synthetic summaries — they would all need to keep passing for legacy).

Related

• #3029 (write-gate validation, merged in PR #3040)
• #3030 (parallel tool-call message merge)