feat(webui): support non-interrupting steering with queued messages

## Background

Issue #2040 introduces deferred sending: when the agent is generating a
response, new user input can be cached in the frontend message queue and
automatically submitted after the current reply ends.

In addition to deferred sending, users may want to use a queued message to
guide the currently running task without stopping the agent or discarding its
partial response.

## Proposal

Add a **Steer** action to each message in the pending message queue.

When the user clicks **Steer**:

1. The selected message is marked for injection into the active run.
2. The current model response continues without being stopped or cancelled.
3. The steering message is consumed at the next safe execution boundary, such
as after the current model call or tool call completes.
4. The agent uses the message to guide the remaining execution of the current
task.
5. Once injected, the message must be removed from the deferred-send queue so
that it is not submitted again after `ReplyEndEvent`.

This does not change tokens that have already been generated. It only affects
the subsequent reasoning or execution after the steering message is consumed.

## Expected UX

- Display a **Steer** action for each queued message while an agent run is
active.
- Allow the user to steer with a specific queued message without affecting
other queued messages.
- Show the message state clearly, for example:
- `Queued`
- `Steering`
- `Injected`
- `Failed`
- Prevent repeated clicks from injecting the same message more than once.
- Keep the current streamed response visible and uninterrupted.
- If the active run finishes before the message can be injected, fall back to
the existing deferred-send behavior instead of losing the message.

## Acceptance Criteria

- Clicking **Steer** does not emit a stop or cancellation event.
- The current model stream is not interrupted or restarted.
- The selected message is delivered to the active run at the next supported
execution boundary.
- The agent can use the injected message during the remaining execution.
- An injected message is never submitted twice.
- Messages that are not selected remain in the queue.
- Injection failures are visible to the user and do not silently discard the
message.
- The behavior works correctly with both model-only responses and tool-calling
workflows.

## Relationship to #2040

This feature builds on the queued/deferred message interaction introduced in
#2040:

- **Deferred send:** process the message after the current reply finishes.
- **Steer:** inject the selected message into the current run at the next safe
boundary without interrupting the in-progress response.