Cloud/frame SDK messages are validated instead of trusted

The adapter that converts remote frame messages into local ones now validates each field before using it. A missing or non-string uuid is replaced with a freshly generated one and logged at error level. Frames whose content is not a string are dropped, as are tool_progress frames with non-string names or non-finite elapsed time, and compact_boundary frames without metadata.

For init frames, model, cwd, slash_commands, mcp_servers and tools are each checked individually: if any arrives in the wrong shape, it is ignored and logged rather than adopted.