fix: renew auto-turn window on explicit resume

[danyel117]

Closes #55

Summary

• reset the auto-turn counter when a user explicitly resumes a goal after reaching max_auto_turns
• keep token and elapsed-time accounting intact, and require a single-use V1/V2 command authorization so the model-callable status tool cannot renew its own safety limit
• harden limit prompts and document the resume behavior

Tests

• bun run lint
• bun run typecheck
• bun test (295 passed)
• bun run build
• bun run pack:dry-run

Claude Opus audits

1. Found one medium issue: the generic status tool could renew the auto-turn ceiling without an explicit user request. Fixed by gating the reset behind a single-use command authorization and adding V1/V2/security regressions.
2. Final audit: no high or medium findings. Six low-severity notes; the highest-priority V2 hook coverage note was addressed before opening this PR.