fix(server): forward review flag events on the thread detail stream

[MTVaught]

Problem

Clicking the follow-up flag in the diff panel appeared to do nothing. The server accepted the command and persisted the flag, but the thread detail subscription only forwards six event types, so thread.review-file-flagged and thread.review-file-unflagged never reached the open client. Snooze and pin do not hit this because their fields ride the shell stream; the flag list lives only on the detail.

Fix

• The detail stream's event filter now includes both review flag events. The client reducer already applied them.
• The flag controls are gated on the server's threadReviewFlags capability, so a client talking to an older server does not show a button that cannot work.
• An engine-level test dispatches flag and unflag and reads the thread back through the detail query, and a unit test pins the stream filter.

Follow-up to #106.

Built with Claude Fable 5.1 via Claude Code in T3 Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.6 KiB	+151 B (+1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+154 B (+2.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	57.1 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.6 KiB	+110 B (+0.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+114 B (+1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.8 KiB	+884 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 1aa2a5d · PR result: e424a9b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.