feat(ckpt): add rollback-by-ancestor-count and snapshot DAG tracking

[Ziqi002]

Description

新增 rollback-by-ancestor-count 功能，支持按祖先步数回滚（--num-ancestors/-n），
与 --snapshot 互斥。为此引入 snapshot DAG 追踪（parent_id/child_ids/head），
在 checkpoint/delete/rollback 时维护双向指针。

plugin 场景下快照发生在 AI 回答之后（head == 当前状态），因此 plugin 侧
对 num_ancestors 自动 +1，保证用户语义一致：n=1 始终表示"撤销上一步"。

Related Issue

no-issue: 新功能，无对应 issue

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• ckpt (ws-ckpt)
• memory (agent-memory)
• anolisa (anolisa-cli)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• For memory (Linux only): cargo clippy --all-targets -- -D warnings, cargo fmt --check, and cargo test pass
• For anolisa: cargo clippy --all-targets --locked -- -D warnings, cargo fmt --all --check, and cargo test --locked pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

• protocol integration tests 已更新
• ws-ckpt rollback -w <ws> -n 1（daemon 场景）验证按步回滚
• plugin 侧 hermes/openclaw 传 n+1 验证语义一致性

Additional Notes

涉及 16 个文件，核心改动集中在 common/lib.rs（DAG 数据结构）
和 snapshot_mgr.rs（指针维护逻辑）。