[arzafran]

What this does

Fixes the High and Medium findings from the 2026-10-01 full audit, plus the cheap Lows. The changes people will notice:

• Closing a window with a running process now asks first (red button and Ctrl-Cmd-W). It used to end the sessions silently.
• Review "Send to agent" no longer types newlines as Return, so a multi-line review cannot run commands.
• File handles passed back from the session holder no longer leak into child processes, and a failed session log write no longer crashes the app.
• Background git status and the review diff can no longer run a repo's core.fsmonitor or diff.external hooks.
• CI downloads of zig are checked against a pinned checksum, and the unit-tests gate no longer fails on PRs that skip the app jobs.
• Socket commands no longer move focus unless they are focus commands. Bad ids return not_found or invalid_params instead of unavailable.

Things existing users will see once

• Each trusted programa.json asks for approval one more time (trust entries now record a per-file digest).
• "Always allow" for external apps resets; entries are now per app and URL scheme.
• install-integration without a terminal needs --yes.
• The CLI no longer connects to a dev, staging or tagged build's socket on its own; it names them in a hint instead.
• Browser cookie commands default to the current site; --all-domains gets everything.

All of these are in the CHANGELOG.

Review order

1. The first commit adds only tests that should fail on the old code. CI should be red on it.
2. One fix commit per area: infra/CI, config and git, sessions, workspace, CLI, app shell, socket.
3. The integration commit wires the cross-area follow-ups.
4. The last five commits fix what the tagged-build check and the cross-model review found: the socket losing its window after a socket-created window closes, Move Up/Down undone by parent/child ordering, out-of-order shell state reports, two test fixes, and close-window refusing the ref new-window prints.

Test plan

• CI is red on the first commit and green on the head commit, every job, not only the required check
• WindowCloseConfirmCancelUITests passes in ui-regressions (red button and Ctrl-Cmd-W, launch window and second window)
• The first-time BonsplitTests run in unit shard 2 is green, or each failure is triaged
• windows-build compiles the new paste confirmation dialog

Checked on a tagged build before opening this:

• Window close with sleep 1000 running: red button 5/5 and Ctrl-Cmd-W 5/5 showed one dialog, and Cancel kept the window
• All seven new socket tests pass against the tagged app, including the three kept out of CI
• tmux resize-pane at a pane's outer edge and the -x shrink refusal behave as tmux does
• Move Up/Down on a workspace with an agent child moves the pair together

After merge (owner)

• Restrict the new release environment to main and move the signing and Sparkle secrets into it.

[arzafran]

Includes #397's two commits (Codex hooks updated in place on reinstall) at the tip.