Plug the deep-embedder holes; remove public.zig escape hatch

Close the gap that forced the CLI to import internal libpanto namespaces,
then delete the transitional re-exports. The CLI now uses only the curated
public surface.

Additions to the public Agent facade:
- init/deinit (heap-pin the inner; the handle is a copyable value).
- addSystemMessage (.append) and setSystemPrompt (.replace).
- compact(override_system_prompt, extra) falling back to the config prompt.
- sessionId() accessor.

CompactionConfig gains compaction_prompt, which owns the compaction system
prompt for both auto-compaction and the explicit compact() default; the
Agent.compaction_system_prompt field is deleted. ConversationData is the
public name for the owned conversation value type (Session.load returns it,
Agent.init adopts it), distinct from the borrowed Conversation handle.

Agent.addSystemMessage/setSystemPrompt are kept on Agent (they persist with
the SystemMode) rather than dropped as the plan first proposed.

1 files changed, 8 insertions, 0 deletions

diff --git a/libpanto/src/config.zig b/libpanto/src/config.zig
index 203a091..5e01bb1 100644
--- a/libpanto/src/config.zig
+++ b/libpanto/src/config.zig
@@ -116,6 +116,14 @@ pub const WireIdentity = struct {
 pub const CompactionConfig = struct {
     keep_verbatim: u32 = 20_000,
     model: ?ProviderConfig = null,
+    /// The compaction system prompt. Used both for automatic compaction on
+    /// context overflow and as the default for an explicit `Agent.compact`
+    /// call (which may override it per-call). Borrowed; set by the embedder
+    /// (e.g. resolved from its `COMPACTION.md` layers, or a built-in
+    /// default). When null, auto-compaction is disabled and a
+    /// context-overflow error propagates unchanged, and an explicit
+    /// `compact` with no override is a no-op error.
+    compaction_prompt: ?[]const u8 = null,
 };
 
 /// Policy for retrying transient provider/API failures. Conservative