fix: panic in atomic save when sanitizeHistory shrinks history

historyOffset was computed from len(history) before sanitization,
but BuildMessages runs sanitizeHistory which can remove messages.
This caused a slice bounds out of range panic when the sanitized
history was shorter than the original.

Fix: compute offset from actual messages slice length instead.

pkg/agent/loop.go

@@ -385,7 +385,9 @@ func (al *AgentLoop) runAgentLoop(ctx context.Context, opts processOptions) (str
 	)
 
 	// 3. Run LLM iteration loop (no session saves until success)
-	historyOffset := 1 + len(history) // skip system prompt + existing history
+	// Offset points to the user message (last element BuildMessages added).
+	// We save from here onward after success (user + any tool-call messages).
+	historyOffset := len(messages) - 1
 	finalContent, messages, iteration, err := al.runLLMIteration(ctx, messages, opts)
 	if err != nil {
 		return "", err