Add configurable operation-history retention and resource bounds

[hyperpolymath]

Problem

ShellState can accumulate operation history without a configurable production retention bound. Existing security and stress tests demonstrate 1,000 entries but do not enforce a maximum, eviction policy, or persistence behavior.

Scope

• Define a configurable maximum history size with a safe default.
• Specify whether eviction is count-, age-, or storage-based.
• Preserve transaction/undo invariants when older entries are retired.
• Define behavior for checkpoints that refer to retired operations.
• Add boundary, stress, persistence, and undo tests.
• Document any interaction with the audit log, which must not silently inherit lossy shell-history retention.

Origin

Split from #88 so that the removed TODO markers in the security and stress tests have a durable behavioral tracker.