fix(pet): stabilize iTerm2 Gajae Pet placement, drag handling, and animation rendering

packages/coding-agent/CHANGELOG.md

@@ -21,7 +21,7 @@
 
 ### Added
 
-- Gajae Pet now renders in iTerm2 using bounded inline PNG frames, with the same reserved composer-side layout and lifecycle cleanup used by Kitty and Sixel.
+- Gajae Pet now renders in iTerm2 through a bounded inline GIF protected from ordinary TUI redraws by a reserved raster lease, with the same composer-side layout and lifecycle cleanup guarantees used by Kitty and Sixel.
 - Added the bundled `ouroboros` dark theme, translating the official navy, teal, green, and gold identity into terminal-safe semantic colors while retaining the pet's vivid `#AEE80E` lime and `#7092BE` cool-scale accents. Live previews now recolor the open `/theme` selector and Settings theme submenu instead of leaving their construction-time theme visible, and confirmation consistently settles the preview into the active appearance mapping.
 - Added the 16×16 `Ouroboros` terminal pet: a vivid lime snake with a cool `#7092BE` underside that rests in a soft coil, blinks, flicks its tongue upward, and occasionally sobs with `><` eyes. Its signature flex rolls the same silhouette through a symmetric circle into an exact 180-degree heart pose, blinks a small pink heart twice, and reuses the authored frames in reverse; agent work enters and exits a stable six-frame infinity loop through explicit unwind transitions. Pet skins now own their frame registry, source resolution, idle loop, work transitions, work loop, and signature burst; a saved skin removed by a later installation falls back to RedGajae while an explicit `off` remains off.
 - `subagent await` now emits periodic liveness even when the awaited subagent's rendered-state signature is stable, so a healthy long wait is never indistinguishable from a hung session. A bounded liveness interval (floor 15s, derived from `heartbeat_ms`) force-re-emits `onUpdate` through the existing update channel, preserving immediate emission on genuine progress changes. Long silent `sleep N` (N ≥ 120s) in bash now appends a one-time advisory notice recommending `subagent await` or `job poll` instead — purely advisory, never blocking (#4465).
@@ -31,7 +31,12 @@
 - `browser` Chrome profile mode (`app.browser: "chrome"`) now defaults an omitted `path` to installed Chrome/Chromium and an omitted `profile_directory` to `"Default"`. `user_data_dir` remains explicit and must be non-default because Chrome 136+ disables remote debugging for default Chrome data directories; Stable/Beta/Dev/Canary/Chromium roots (including trusted Linux environment, Flatpak, and Snap defaults), symlink aliases to them, and non-Chrome browser executables are rejected with remediation instead of timing out or risking cross-brand profile access. Profile and Windows executable discovery use trusted environment sources that ignore repository `.env`, platform path semantics are preserved, executable/profile-root canonicalization races stalled filesystem work against cancellation, the canonical Snap Chromium launcher is admitted only when it resolves to `/usr/bin/snap`, and wrapper-launched Linux Chrome processes are reused through an abort-aware asynchronous `/proc` scan only after kernel executable identity plus exact profile/loopback-CDP guards pass. Cancellation propagates before, during, and after CDP probing, and omitted profile names render as `Default` in the TUI.
 - Defense-in-depth: when an Anthropic-origin assistant transcript message carrying directly adjacent `thinking`/`redacted_thinking` blocks is persisted, a single bounded warn is emitted per session manager instance — but only in development/test builds, never in production. The diagnostic names only the envelope shape (block count, adjacency presence, provider), never raw thinking text, signatures, redacted payloads, or transcript-path metadata. Storage is never mutated — the send-boundary collapse remains the wire source of truth; this is a read-only observation that helps surface upstream producers of the rejected shape (#4443).
 ### Fixed
-- Gajae Pet now keeps its intended two-row footprint in iTerm2 across terminal font, Retina, and cell-geometry changes instead of rendering as a fixed undersized pixel box.
+- Ouroboros now keeps its own authored base, idle, work-transition, work, and burst frames across Sixel, Kitty, and iTerm2 rendering. Marked iTerm pet drag paths are also discarded in Bash and Python composer modes instead of being inserted literally.
+- iTerm2 pet animation now stays silent while the TUI is temporarily stopped for an external editor or todo edit, preventing raster writes from corrupting the child terminal session. Its unavailable-capability deadline now begins after iTerm probing starts rather than during initialization work.
+- Forced Kitty Gajae Pet graphics remain unavailable inside tmux, screen, and zellij; forced Sixel and verified iTerm2 transport keep their existing behavior.
+- iTerm2 Gajae Pet rendering now uploads an animated GIF only when its meaningful state changes and holds a raster lease across ordinary TUI redraws, preventing work-animation flicker and transient composer-background frames.
+- Dragging an iTerm2 Gajae Pet image no longer pastes its temporary named image pathname into the composer. Pet frames identify their generated image by name, and the paste controller consumes only that marked pathname while preserving native iTerm dragging and all other image-path pastes.
+- Gajae Pet now keeps its intended two-row art footprint in iTerm2 across terminal font, Retina, and cell-geometry changes instead of rendering as a fixed undersized pixel box.
 
 - Post-merge repair for #4542: `CHAT_DAEMON_GENERATIONS.discord` 64→65 and `.slack` 67→68 so the `SessionRouter` initial attachment replay change is generation-fenced for already-running Discord and Slack daemons. The semantic guard manifest is regenerated with the corrected generation and declaration digests.
 - Cursor split responses now preserve canonical provider order across pre-admission artifact spilling, so a server-side tool result cannot be persisted after the assistant continuation that follows it. The canonical admission reservation is owned by each emission's own handler, so a host bridge or replay emitting the same `message_end` event object twice can no longer overwrite the reservation and deadlock every later canonical admission (#4536).