fix(server): macOS support for the idle gjc lane + live detection — remove comm/lsof/proc/locale Linux assumptions

[thisisjun786]

Scope (updated — grew beyond the original detection port)

This PR started as the macOS port of the idle gjc lane and now carries four layers, in commit order:

1. macOS live/idle detection (supersedes and includes PR fix(server): macOS support for live gjc session detection — remove Linux-only lsof/proc/locale assumptions #1): lsof comm filters, ps snapshot ancestry (no /proc), batched lsof -d cwd, launchd no-locale LANG defence, argv-based gjc evidence for the idle lane.
2. Idle first-message UX: idle rows open a main-area waiting view (single MainTakeover union), first message relays via the tower, the view auto-resolves to the real conversation once its transcript appears. Pure transition helpers in idleTransition.ts with 25 unit tests. Multi-candidate cases never auto-switch (banner + manual pick).
3. UX polish: per-row subtitles → tooltips, non-tmux gjc sessions hidden from the live list (they stay in the internal live set so read-only banners/LIVE badges keep protecting them), post-send boost polling (5s→1s for 30s), spawn-name pre-validation, workspace-root autocomplete for the spawn form (scope=spawn, absolute paths — home-relative contract of the files panel untouched).
4. Review-driven hardening (independent architect-lane review, verdict REQUEST CHANGES — all blocking findings fixed here):
   • HIGH tmuxId ($N generation token) is now REQUIRED for send/kill; omitting it used to skip the same-name replacement guard entirely. Missing/malformed → 400; stale → 409. Client fails closed when it has no token.
   • HIGH gjc argv evidence narrowed to argv[0] or a bun/node first script argument — vim /tmp/gjc and shell command strings no longer promote a pane to a lineage claim.
   • MED transcript-lane lsof is scoped to proven gjc pid trees (one ps snapshot + descendant BFS) instead of every bun/node process — protects the 4MiB/4s subprocess guard on node-heavy hosts.
   • MED waiting view detects generation replacement even when the new generation appears only as a real transcript row; the 15s resolving timeout now actually bounds background project refetches (recovery navigation stays).
   • MED workspace spawn suggestions return absolute paths, so a home/workspace name collision can no longer spawn somewhere other than what the picked suggestion displayed.
   • LOW autocomplete no longer resurrects stale responses after the input is cleared.

Verification

• 88 unit tests pass (tsx --test, server 52 / client 36), tsc --noEmit both configs, ESLint clean on touched files.
• Deployed on a real macOS host (launchd + tailscale serve): live rows for tmux sessions with generation tokens, idle rows for pre-first-message panes, waiting-view auto-transition observed end-to-end (~14s pre-boost, ~1-2s detection latency after a relayed send with boost polling), 400/403/409 contract probed over HTTP.
• A wiring regression found right after deploy (3-column ps snapshot fed into the 2-column parser zeroed all detection) is fixed and pinned by a dedicated test.

Open questions for the maintainer (deliberately NOT changed here)

• i18n: new UI strings follow this branch's existing hard-coded-Korean convention; the reviewer flagged the repo's useTranslation layer. Happy to move them to locale keys if you want that direction.
• resolveAllowedRoots direct-child symlink trust (pre-existing): the reviewer suggests an explicit decoy-root contract instead of trusting every top-level symlink. Separate PR if you agree.
• External CLI attach by name only (pre-existing): could carry $N like the gjc lane; separate PR.
• History is append-only per review discipline; squash-merge (or ask for a rebase) if you prefer a clean history.

Merge order: #1 first then this, or this alone (it strictly contains #1; note #1 alone still has the broad lsof -c bun -c node cost — its fix lives here).