[vanedaltro]

The hex workspace can now stage and review edits, then explicitly save or Restore Last Save through the native owner service.

• Add reviewed save/restore/reconciliation routes with stable operation IDs, current read/edit and sandbox checks, and retained worker authority immediately before native intent. Lost responses do not automatically replay an exchange.
• Add terminal edit mode, complete-byte overwrite, explicit hex/UTF-8 insertion and replacement, selection/copy/delete, draft undo/redo, review paging, and unsaved-draft close choices. SDK helpers use the same routes.
• Share published saved-source history between authorized Sessions and include durable binary references in Session diffs outside Git and ordinary snapshot size limits. Private unsaved journals stay separate; notification delivery does not control saved-history visibility.
• Update generated API/SDK artifacts, README/roadmap/feature docs and real terminal screenshots.

Validation: production-router save/retry/restore/history/diff regression, including revoked read/edit permissions, cross-Session refusal and injected notification-journal failure; targeted binary core/catalog and 15 hex/TUI tests; OpenAPI artifact checks; SDK typecheck, 125 unit/mock tests (ten external tests skipped in that selector), plus a separate real-executable binary SDK test; core/server/TUI all-target Clippy; strict OpenSpec validation (114 items). The rebase onto merged #102 preserves the tested source tree.

Model binary operations, configured retention/checkpoint/rewind adapters and remaining performance/accessibility/platform acceptance remain under #94. This PR does not close that issue.