Add first-class HTTP exchange artifacts

[portswigger-penguin]

What changed

• Add stable extension-owned handles for HTTP exchanges from Proxy, Organizer, site map, Repeater results, and MCP sends.
• Keep a bounded in-memory registry with deterministic request/response fingerprints and temp-file-backed snapshots.
• Add compact search_http_messages metadata and selective inspect_http_message body/header windows.
• Expose source liveness, snapshot availability, service/status/MIME metadata, timestamps, and Burp annotations.
• Apply existing data-access approval controls to the new artifact sources.

Why

Montoya does not expose durable IDs across all HTTP surfaces. Explicit handles let MCP clients search compact metadata and inspect only the required exchange parts without returning entire messages or relying on protocol-session state.

This intentionally does not add a database or cross-restart persistence. Burp's copyToTempFile() provides snapshot lifetime for the running suite, while the registry stays bounded to 1,000 entries.

Impact

Agents can reliably refer back to an exchange after its original source item disappears, while keeping large requests and responses out of default tool results.

Validation

• ./gradlew test
• 105 tests passed in the implementation run; final rerun completed successfully.
• Focused assertion-quality audit passed after strengthening snapshot-retention and Repeater negative-pair coverage.

Stacked on #116 (agent/fix-tool-contracts).