fix: harden runtime and terminal recovery

[almogdepaz]

summary

• integrate fix(mobile): preserve scrollback on session switch #176 mobile session-switch scroll preservation and fix(ralph): enforce configured agents #177 configured Ralph-agent enforcement
• remediate the current EDC security/correctness findings across broker transport, server validation, persistence, service installation/authentication, push delivery, and release policy
• make terminal hydration fail closed until prefill completion, with bounded timeout/reconnect behavior
• unify single/grid recovery behavior while preserving their intentional full-versus-viewport prefill policies
• add shared takeover fallback, per-cell recovery snapshots, Command-key scroll-lock handling, and replacement hydration
• hide topology-affected Ghostty canvases during grid relayout, repaint at settled geometry, then reveal to prevent stale framebuffer artifacts

notable contracts

• desktop single sessions retain full prefill; grid and mobile-fast paths retain viewport prefill
• incomplete prefill is never revealed; missing completion closes with code 4003 and reason prefill timeout
• broker/session/persistence failures propagate or fail closed rather than reporting false success
• installer validation completes before binary replacement or setup side effects
• service JWT material is supported through private auth files; JWT provisioning remains opt-in and is not enabled by this PR
• release actions are pinned to immutable SHAs with least-privilege publication credentials

included pull requests

• supersedes fix(mobile): preserve scrollback on session switch #176
• supersedes fix(ralph): enforce configured agents #177

verification

• bun test --max-concurrency 8: 1,695 passed, 0 failed
• cargo test --manifest-path broker/Cargo.toml: 174 passed, 0 failed
• bunx playwright test: 83 passed, 103 skipped, 0 failed
• focused desktop grid suite: 18 passed, 0 failed
• TypeScript typecheck passed
• generated public assets were deterministic
• git diff --check passed

live validation

• deployed version 1.6.7 on the development host
• repeated desktop/mobile hydration, reconnect, takeover, session switching, and 2→6-cell grid transitions completed without console errors
• grid topology transitions synchronously hid existing canvases until fit/repaint completion
• deployed and source bundle SHA-256 matched: 74d6edd964c389d0b065caeeda23811b6a1aa771430a524bf498b78fd368f1d2
• temporary validation sessions were removed