Remote session client drops __proto__ members from incoming messages

What

When Claude Code runs as a headless client for a cloud session, it receives messages, called frames, over the connection. It now cleans those frames before using them:

• A member named __proto__, a special property name in JavaScript that can be misused, is removed and a warning is logged.
• A second filter is meant to remove a tag that a session is not allowed to set. As written, it returns the frame unchanged, so it never removes anything, and its warning can never appear.
• The client's statistics gain two counters, reservedTagsDropped and protoMembersDropped, alongside the existing counters for dropped frames.
• Separately, a failed transcript compaction now reports an error code with its reason, and stream statistics gain a count of tagged lines.

Why

The __proto__ guard is real protection against malformed incoming messages. The reserved-tag filter has no effect in this release.