Fix pipeline tool result rendering

[guima-why]

Summary

• trust transcript-local tool result and image cache artifact directories so follow-up shell reads do not require extra approval
• compact noisy pipeline validation errors for complete_step and ask_user_question in live rendering and legacy replay
• harden tool render metadata persistence to JSON-safe known keys and render cloud API summaries from the current output payload

Root Cause

• Transcript artifact directories were not treated as trusted task-local paths.
• Pipeline schema validation errors were stored/rendered as raw provider-facing validation text, which made the UI dump large error messages.
• Cloud API compact rendering could use cached _last_result data instead of the current tool output, causing repeated-looking RequestId rows in compact UI.

Validation

• uv run pytest tests/pipeline/engine/test_ask_user_question_tool.py tests/agent/test_agent_loop_new.py tests/ui/test_renderer_helpers.py tests/test_i18n.py tests/tools/cloud/test_base_api.py -q -> 168 passed
• make lint -> ruff and ty passed
• Earlier full suite on this branch: make test -> 8554 passed, 1 skipped