feat(curate): wire chi:"curate" end to end

[adiled]

chi:"curate" has been in the registry since the protocol was written — "manual compaction request" — but nothing behind it was connected:

• humd dropped it in the thrum.recv.todo arm (humd/src/lib.rs:1622), alongside ReleasePermit, PetalCell, Drone…
• no worker handled it — nest-common's loop knows prompt, cancel, tool-result, breath/echo
• graft::prune_jsonl was implemented and covered by tests, with no production caller anywhere in the tree

Three pieces of one feature, none of them joined. This joins them. A bee can send chi:"curate" and a transcript actually gets trimmed.

What changed

humd — forward Curate to registered workers, the same twelve-line shape as the Cancel and Cleanup arms directly above it. Workers no-op on an unknown sid, so spraying stays safe until sid→worker routing exists.

nest — WorkerBee::curate(sid, cwd) -> CurateReport, defaulting to a no-op so hives with nothing to trim are unaffected.

It takes a cwd rather than a live Cell deliberately. claude -p exits after every turn, so a curate almost always arrives with no cell running — the transcript on disk is the state worth trimming, and it outlives the process that wrote it.

nest-common — handle "curate" in the worker loop and advertise it in the hello's chis. Adds a small sid → cwd LRU populated from prompts, because a curate names a sid but no cwd, and the transcript lives under one.

claude-cli — implement curate through the existing prune_jsonl: strip thinking blocks, clip oversized tool results, protect the most recent turns.

Tests

hives/claude-cli/tests/curate.rs:

• curate reaches the right transcript for a sid and honours the protection window
• curate on a sid this bee never raised a cell for is a no-op, not an error — routine, since humd sprays to every worker

Both hold the same HOME guard graft_integration.rs uses; HOME is process-global and cargo threads these.

cargo check --workspace clean. claude-cli and nest suites pass.

Notes

• ReleasePermit stays in the TODO arm. It resolves a permission-ask, and no bundled hive emits one yet — that's a feature rather than a gap-fill, and it doesn't belong here.
• The report carries bytes_before/bytes_after of the re-serialized entries, so they track the transcript's size without matching the raw file byte-for-byte.
• Found while porting a consumer onto thrum: a forager asking for compaction has no way today to tell that nothing happened, since the tone is accepted and echoed either way.