fix(core,web): normalize inner Claude tool input instead of rejecting it

[That1Drifter]

Summary

A fresh-eyes Sonnet playthrough surfaced that ~half of first attempts on staging were 500ing with `inner claude tool call did not match contract` (the throw at `apps/web/lib/inner-claude.ts:401`). This is a regression from the tool_use migration in #14 — the runtime guard `isInnerClaudeResponse` was stricter than the `emit_turn_response` tool's `input_schema`, so when the model omitted an empty optional field (no stakeholder messages that turn), the API accepted the tool call but our runtime guard rejected it.

What changed

• Replaces the boolean guard with `normalizeInnerClaudeResponse` that fills sane defaults instead of rejecting:
  • `environment_delta` missing or null → `{}`
  • `stakeholder_messages` missing or non-array → `[]`
  • `surprise_triggered` missing → `null`
  • `hidden_state_updates` missing → `undefined`
  • `visible_effects` missing or whitespace-only → reject (the only hard requirement, since without it the trainee literally sees nothing this turn)
• Fixes the `typeof null === 'object'` trap the old guard fell into. `environment_delta: null` would have passed the old check then crashed at the first `.new_tickets` access. Normalize coerces it to `{}`.
• `isInnerClaudeResponse` is kept as a thin wrapper over `normalize` so external callers stay source-compatible.
• Both call sites in `inner-claude.ts` (first call + retry) switch to normalize and use the normalized value.

Tests

Adds 9 unit tests in `packages/core/src/tests/contract.test.ts` covering the partial-input cases that broke the playthrough (each missing field, the typeof-null trap, hard visible_effects requirement, non-object inputs, and the wrapper-stays-in-sync invariant).

Test plan

• `pnpm test` — 26 core tests pass (17 existing + 9 new)
• `pnpm typecheck` — clean across 6 packages
• `pnpm lint` — clean
• Smoke on staging: drive 5+ turns and confirm zero contract errors in normal play

This is one of the three critical bugs the fresh-eyes playthrough surfaced (TODO Now section). The other two — page-reload session loss, debrief visual structure — will follow in separate PRs.

[That1Drifter]

Smoke results + follow-up commit

Deployed the original fix and ran 8 turns. 2 of 8 still failed with the contract error, but with the new diagnostic `console.error` we can finally see exactly what the model is returning.

What Haiku is actually doing wrong

Two distinct failure modes, both ~1-in-5 frequency on the cheap model, almost never recurring on retry:

Mode 1 — undercomplete tool call. The model emits ONLY `environment_delta` and skips everything else (no stakeholder_messages, no visible_effects, no surprise_triggered). The lenient normalizer correctly rejects because visible_effects is missing — without it the trainee literally sees nothing.

Mode 2 — stringified blob. The model emits `stakeholder_messages` as a JSON-encoded string containing the array AND the sibling fields:
```
"stakeholder_messages": "[\n {\n \"from\": \"marcus\", ... }\n],\n \"visible_effects\": \"...\",\n \"surprise_triggered\": null\n}"
```
Top-level visible_effects is then missing because the model packed it inside the string. Same rejection.

Fix in 9475d7b

Widens the existing retry path to fire on normalize failure, not just on `stop_reason === 'max_tokens'`. Adds a corrective hint message specifically for the malformed-tool-input case ("emit each field as a top-level key, NOT packed into a stringified blob"). The truncation hint stays unchanged for the truncation path.

Also keeps the diagnostic `console.error` as a permanent observability hook — if a future failure mode evades both layers, we'll see the offending input in the server log instead of having to add print statements again.

Re-smoke results

10 consecutive turns through support-triage with the new commit:

```
turn 1: ok (first)
turn 2: ok (first)
turn 3: ok (first)
turn 4: ok (first)
turn 5: ok (retried) ← undercomplete tool call recovered
turn 6: ok (first)
turn 7: ok (first)
turn 8: ok (first)
turn 9: ok (retried) ← stringified blob recovered
turn 10: ok (first)

TOTAL: 10 attempts, 0 user-facing errors, 2 recovered via retry
```

The retry rate (~20%) matches the per-call failure rate the playthrough originally surfaced, but it's now invisible to the user — the failures get auto-recovered and only show up as a `retried: true` flag and an extra cost line.

Ready to merge.

[That1Drifter]

Re-smoke with the prompt tightening: 15 turns, 0 user-facing errors, 2 recovered via retry (~13%, vs ~20% in the previous run). Sample's too small to claim a clean win on the prompt change alone, but it's cached, zero-cost per turn, and documents the contract more explicitly. Net positive. Ready to merge.