fix(settings): defer activity log loading and bound reader buffers

[kitlangton]

Why

Opening Settings synchronously scanned the accumulated diagnostic log even though Settings does not display it. The reader also held several full-file byte buffers before keeping only 1,024 events. A synthetic 64 MiB log consumed about 204 MB peak process RSS in an isolated reader harness.

What Changes

• Settings opens and reopens without loading event history; Commands and developer Activity load it when needed.
• The reader streams a fixed file-length snapshot in 16 KiB chunks, preserving retained rows, session boundaries, and context older than the visible rows.
• Partial UTF-8 and CRLF records survive refresh boundaries. Diagnostic records larger than 1 MiB are skipped through their newline without modifying the log or dictation output.
• File identity comes from the opened file. Truncation resets parsing without losing the identity needed to detect a subsequent replacement.

Measured: the same 64 MiB synthetic fixture used about 2.4 MB peak RSS after the change. Reader refresh took 254 ms before and 222 ms afterward. This is an optimized standalone harness using the production reader, not installed-app latency evidence.

Scope

This fixes eager Settings I/O and whole-file buffering. First-time Commands/Activity loading still scans the log snapshot; background parsing and disk rotation are separate follow-ups.

Verification

bun install --frozen-lockfile # from sdk
bun run --cwd sdk/commands build
cargo test --locked --bin voice-control reader_
cargo test --locked --bin voice-control activity_log_is_only_read
cargo test --locked
cargo clippy --locked --all-targets --all-features -- -D warnings
cargo fmt --check
git diff --check

490 Rust tests and all 12 keyboard-layout child scenarios passed; 12 opt-in native tests were skipped. Strict Clippy, formatting, and whitespace checks passed. New tests cover lazy pane loading, streamed retention/context, oversized records, split Unicode, truncation, and replacement. Native Settings interaction and Linux runtime checks were not run locally.