Speak into a thread that is already running

Nobody has claimed this yet.

Depends on the threads issue. This is the hard one and should be scoped carefully
before anyone writes code.

A person delegates "get the September invoice", watches for ten seconds, and realises
they meant October. Today there is nothing they can do: the loop is running, the API
is one-shot, and their only option is to wait for the wrong answer.

## Why this is not just plumbing

The agent loop observes, decides and acts in a cycle. Injecting a new instruction
means deciding:

- **When it is read.** Between iterations is the only safe point — never mid-action.
- **What it can do.** Amend the goal, add a constraint, or stop. It must NOT be able to
grant permission for something already pending; an approval is a human decision bound
to a hash, and a follow-up message is not that.
- **What the agent tells you.** A silent course change is worse than none. The thread
should show that the instruction was received and what the agent did about it.

## What to build

`POST /api/threads/{id}/messages` on a thread whose state is `Working` queues the
message for the running loop. The loop checks the queue at the top of each iteration
and folds any waiting message into its context, then appends a line to the thread
saying it did.

A `stop` is a separate, immediate path — it should not wait for the next iteration.

## Deliberately out of scope

Approving anything. Changing which session a thread runs in. Editing past messages.

## Acceptance

A message sent to a running thread changes what the agent does next, the thread shows
the change was picked up, and a message sent to a finished thread starts new work
rather than silently disappearing.

Start with the threads issue, then locate the implementation of the Working thread loop and its iteration boundary. Trace how POST /api/threads/{id}/messages, queued instructions, stop requests, and finished-thread messages are handled. Done means running threads apply messages between iterations, record that change, stop immediately, and restart work when a finished thread receives a message.

Written by the indexing model from the issue text.