feat(acp): show the command in execute titles; test via the real bash tool; RFC for terminal rendering

- bash presentCall title is now "description — command" (e.g. "List files in
  src — ls -la src"). An execute-kind ACP card HIDES rawInput (Zed renders it
  only for non-terminal tools), so the command must ride in the always-visible
  title to be seen — matching how claude-agent-acp/codex-acp title execute
  tools. The command stays in rawInput too for non-execute UIs that show it.
- Rework the acp tool-call presentation tests (turns + load replay) to drive the
  REAL dsh-tool-bash + dsh-bash-local via a new makeBridgeHarness({ withBash })
  option, running an actual `echo` — instead of an inline fake bash tool. The
  mock MODEL still scripts the call (deterministic, no key), but the tool and
  executor are real, so the test verifies the shipping presentCall/presentResult.
- AGENTS.md: add the principle "prefer the REAL implementation over a mock/
  stand-in in tests" (mock only the expensive/non-deterministic boundary).
- RFC (proposed): the ACP terminal sub-protocol + command classification — the
  capability-gated rich rendering (live cwd-header terminal card, classify a
  `cat` as a read / `grep` as a search) that the reference adapters do; the
  fenced ```console text block stays the no-capability baseline. Studied
  codex-acp, claude-agent-acp, and Zed's renderer to ground it.

packages/acp/src/index.ts

@@ -788,8 +788,15 @@ interface ResolvedResultPresentation {
  * both), the presenter remembers each `tool/call`'s `{ name, args }` keyed by
  * callId and looks it up on the matching result. The map is bridge-LOCAL (not a
  * change to the event schema or a core service): one presenter per live session
- * (and a throwaway per `session/load` replay), entries removed as each result
- * arrives, so it holds only the currently-in-flight calls.
+ * (and a throwaway per `session/load` replay), and each entry is removed when
+ * its result arrives. In the normal loop a `tool/call` is always followed by a
+ * `tool/result` (the registry turns even a thrown tool into an isError result),
+ * so the map holds only currently-in-flight calls. The one exception is a step
+ * torn down mid-tool (an abort between `tool/call` and `tool/result`), which can
+ * leave a single stale entry per such call; this is bounded by the session
+ * lifetime (the whole presenter is dropped on teardown) and never affects
+ * correctness — a later result for a different callId is unaffected, and the
+ * stale entry's only cost is one map slot until the session ends.
  */
 export class ToolPresenter {
   private readonly pending = new Map<string, { name: string; args: unknown }>()