Live sessions: user-controlled startup restore

[raiseCatError]

Closes #197

Behavior

• Settings (Config → Sessions, persisted in the existing config): liveSessionStartup = Ask (default) / Always / Never; liveSessionMultiple = Ask which (default) / Open all. Unknown values fall back to the defaults.
• One detached session, Ask: a prompt shows the cwd, the running command (or idle) and its age.
  • R / Enter: resume.
  • N / Esc: start fresh and leave the session running.
  • A: save Always, then resume.
  • D: save Never, then start fresh, without killing anything.
• Always: one detached session resumes without a prompt. With several, the multiple-session setting applies.
• Never: no prompt or picker at launch. Sessions keep running and stay in /resume.
• Several, Ask which: a picker with ↑↓, Space to toggle, A for all (again to clear), Enter to resume the selected sessions, and Esc (or Enter with none selected) to start fresh. Unselected sessions keep running.
• Open all: every detached session is restored.
• Neither screen has a destructive key. --new and --attach <id> are unchanged. Attached sessions are never candidates, since attach is exclusive at the service.

Opening more than one

This window attaches the first chosen session. Each other one runs nmsh --attach <id> in a new host window, via src/host/terminalHost.ts:

• detectTerminalHost returns an optional newWindow(argv) launcher: Ghostty on macOS (AppleScript: new surface configuration + new window with configuration, a normal window in the running app, with the command words passed as osascript argv), Ghostty on Linux (ghostty -e), Terminal.app (AppleScript do script), and kitty (kitten @ launch --type=os-window).
• VS Code, Zed and unknown hosts have none.
• openWindows takes an injectable spawner and reports every command it could not open. The current window then names each remaining session's nmsh --attach command. Nothing selected is dropped or ended.

Also fixed

• The launch notice was added before a reattached journal was restored, which erased it. That affected Live sessions: stale-session cleanup, crash recovery and hardening #131's recovery notice too. It is now added after the restore.
• The startup screens treat a read ending in a lone ESC as Esc (Space then Esc can arrive as one read and used to hang).
• A lifecycle test waited for any running command, so it could kill the frontend while the previous echo was still marked running. It now waits for the gated command.

Tests

• tests/startupRestore.test.ts: config defaults and validation, the launch plan for every policy combination, prompt and picker keys and rendering, host detection and command construction (including quoting), openWindows with a fake spawner, and orchestration (persisting, not-now, Never, selection, Open all, unsupported and failing hosts).
• tests/startupDiscovery.test.ts (real PTY, nmshd and zsh):
  • Ask prompt, with Not now, Esc and Resume.
  • Never and Always persist, and Never ends nothing. /resume still lists the skipped session.
  • Picker selection and Esc, with the unselected sessions still detached.
  • Open all with the fallback notice.
  • No hijack of attached sessions.
• The test sandbox pins a neutral host, so tests can never open real terminal windows.
• Build, typecheck and git diff --check are clean. The combined live PTY files passed 10 consecutive runs, and a full-suite run passed 568/568.
• Other full-suite runs had 1–2 timing failures, each in a different test. The machine's load average was ~29 from unrelated processes, and unmodified dev failed 2–4 tests per run under the same load.

Limitations

• Ghostty on macOS needs its AppleScript support enabled (the default) and asks once for macOS Automation permission. If either is unavailable, the fallback message names the nmsh --attach command.
• Terminal.app asks once for macOS Automation permission.
• kitty needs allow_remote_control.
• If an extra window's explicit attach fails, that window reports the error and exits. The session stays detached and listed in /resume.
• Multi-window behavior is not verified automatically and needs physical QA.