identity: save binary responses to workspace

[antra-tess]

Problem

identity--request always called Response.text(). Binary service assets therefore entered model context as corrupt UTF-8 and were truncated before an agent could save or inspect them.

Change

• Read response bytes once and classify from content type, with no-header JSON compatibility.
• Binary without saveAs: return only {size, contentType, sha256} and a safe instruction.
• Optional saveAs writes exact bytes through WorkspaceModule.writeBinary, preserving Chronicle/materialization behavior, and returns path + hash.
• Preserve existing JSON/text behavior and 24 KiB inline truncation.
• Bound fetched bodies at 64 MiB.

Evidence

• Added a byte-exact PNG test including invalid UTF-8 bytes.
• bun test test/identity-and-surfaces.test.ts: 8/8 pass.
• bunx tsc --noEmit reaches one pre-existing unrelated error in frontdesk-strategy.ts:168; no new identity errors.

This fixes the general host seam; Orrery remains unchanged.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.