Release BI — stage-378 — 3-PR review-bypass batch

Three contributor PRs, all pre-approved by independent review before staging.

Fixed

#2145 by @swftwolfzyq — Prevent internal [Workspace::v1: …] metadata from leaking into the visible user transcript when a failed provider/retry path echoes an optimistic draft followed by the workspace prefix and the real prompt. Adds _looks_like_current_user_turn(msg, msg_text) (exact-match-after-strip; no substring fuzz) and routes the merge/dedupe/display-normalization paths through it. Replaces _has_new_assistant_reply length-delta gating in _periodic_checkpoint with _assistant_reply_added_after_current_turn, which slices result messages from the current-turn position before counting assistant deltas. Silent/no-response failures are now detected from the current turn alone instead of being masked by prior assistant content.
#2146 by @swftwolfzyq — Track WebUI update checks against the latest published release tag instead of every commit on the upstream branch. Operators who only want released versions stop seeing noisy banners for post-release development commits. Falls back to branch-based detection when no release tags are available. Splits git describe --dirty into a fast base describe plus a bounded dirty probe (timeout=1), so WSL-mounted workspaces never block version detection on a slow --dirty walk.

#2469 by @Michaelyklam (refs #1925) — Advance the runtime-adapter RFC after the Slice 2 seam shipped. Marks Slice 2 complete and defines the first Slice 3a cancel-control gate. The gate scopes Stop Generation through RuntimeAdapter.cancel_run(...) only, pins behavior-preserving cancellation, journal/status coherence, idempotent duplicate cancel, and explicit non-goals for approval/clarify, queue/goal, runner/sidecar, and public chat-start response changes.

pytest: 5866 passed, 6 skipped, 3 xpassed, 0 failed
Opus advisor: SHIP — verified the _looks_like_current_user_turn empty-needle guard, _assistant_reply_added_after_current_turn _error: True invariant, no cross-interaction with v0.51.83 PR #2439's journal-replay path, dirty-probe bound (timeout=1) on git diff-index --quiet, and _release_gap returning 0 when current==latest
Browser API sanity: all 11 endpoint checks PASS on isolated port-8789 stage server
CI: 3.11 / 3.12 / 3.13 all green