Integrate native Agent chat with Atem chat-v1 and remote terminals

[guohai]

Astation can now consume the published Atem chat-v1 host contract (Atem PR 65, commit 10d3ea8). The browser shows local and remote prompts, typed text/tool replies, explicit turn outcomes and honest semantic status, while retaining the original agent terminal for approvals.

This also brings the previously uncommitted native terminal/browser bridge onto current main. It includes authenticated terminal ownership/recovery, bundled renderer assets, and the existing Mac-password fallback work for closed-lid verification/unlock.

• Add typed message/part deduplication, optimistic prompt reconciliation, older history and safe reopen without prompt replay. Accept late parts after completion, pre-session errors and headerless close.
• Pin the exact authenticated Atem connection, agent and process generation; gate submission on fresh Ready, stop on revocation/gaps/restarts, and preserve accepted delivery across disconnection. Bound both content and serialized message metadata, including empty parts. The relay remains transport, never identity or encryption authority; chat is not E2EE.
• Render CommonMark through DOM APIs with pinned local parser assets. Raw HTML, image URLs and unsafe links cannot execute. Keep the canonical /agent/ and /stoa/ routes.
• Document lifecycle, security, host support and recovery before implementation. Run one shared published-wire fixture through native and browser tests.

Validation:

• Debug/Release builds, Release and packaged-app resource checks, and all eight pinned terminal assets pass.
• 97 web/automation tests, codec/nginx config checks, and Chrome at 1440/390/320 pixels pass. A signed mock bridge checks history/reload without replay, tampering, duplicate parts, late content and unsupported hosts.
• Available Swift run: 802 tests, seven expected skips, zero failures, with six environment-sensitive checks excluded locally. The full run exposes five protected Keychain/Secure Enclave checks returning macOS -25308 and one caption-wheel assertion that also fails on unchanged main. Provisioned signing did not remove those local restrictions. CI still runs every test; no CI test exclusions were added.

Hosted CI passed on the latest head cd9b168 (run 38687952547): macOS build and 808 Swift tests (10 skips, zero failures), webapp/nginx checks, and relay/Postgres/Valkey tests. No new CI exclusions were added.

Draft acceptance gate: run a harmless real task through the exact authenticated Claude session launched by an updated Atem with active hooks, observe an actual reply/completion, and reopen without resending. Atem v0.6.19 predates PR 65. Existing user Atem/Claude/key-agent processes were preserved. The current running Astation was not replaced, and this change is not deployed.

Generated with SMT smt@agora.build

[guohai]

Superseded by #49, which now targets main and retains both commits from this PR together with the session-v1 client. Consolidating review and release in #49; nothing has been merged or deployed. #49 remains a draft pending live integration with the Atem r5 host.