fix(identity): restack overlay onto latest fork/changes - #285

* feat(server): run blocking lifecycle scripts before worktree removal

Add runOnWorktreeRemove and runOnPrMerged project script hooks so process
and data reaping can finish before git worktree remove continues. Non-zero
exit blocks removal. Also expose the flags in t3.json, scripts UI, and docs.

Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

* fix(server): trigger runOnPrMerged on open→merged, not on remove

Decouple PR-merge lifecycle from worktree removal. Fire runOnPrMerged when
VCS remote status observes the same PR transition open→merged (once per
cwd+PR). Worktree remove only runs runOnWorktreeRemove and waits for exit.

Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

* feat(server): pass linked PR association env to lifecycle scripts

Expose T3CODE_PR (URL preferred) plus number/url/title/base/head/state for
the change request associated with the worktree branch. Populate on PR merge
and on worktree remove when status knows the linked PR.

Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

---------

Co-authored-by: omegent-app[bot] <306514130+omegent-app[bot]@users.noreply.github.com>
Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

…fixes

Identity product layer based on current fork/changes: session claims,
source attribution, participant UI (#247), and Jira queue/inline replies
(#248), with mobile typecheck fixes for stage label and toolbar clearance.

)

Mine/Ours now keeps threads with no person tags (legacy, channel-only
stamps like desktop, identity-disabled servers). Theirs is only threads
that have person attribution excluding the session claim.

Co-authored-by: omegent-app[bot] <306514130+omegent-app[bot]@users.noreply.github.com>
Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

…pply

Identity product reapply had dropped the mobile model-selection helper
while new-task-flow still imported it, breaking mobile typecheck.

…#256)

Remember Mine/Theirs across mobile restarts via device preferences, and
let Mine/Theirs refine by created, participated, or both (default).

Co-authored-by: T3 Code PR Stack <41898282+github-actions[bot]@users.noreply.github.com>

Created looked only at origin, so Theirs+Created included threads you
joined (origin ≠ you) while Theirs+Both required you to be absent from
every person tag — Created could show more than Both. Classify involvement
first, then narrow by role so Both is always the superset.

Co-authored-by: T3 Code PR Stack <41898282+github-actions[bot]@users.noreply.github.com>

Keep mobile-showcase landscape harness typing from fork/changes when
rebasing the identity overlay; identity reapply had dropped the field.

Keep checkForAppUpdateOnLaunch wired after product-merging snooze
actions into the identity HomeRouteScreen.

Production showcase deep links use t3code://; identity reapply left
t3code-dev:// expectations that fail after restack compose.

Jira and GitHub treat an unset/empty identity map like an unmapped actor:
no agent turns. Only mapped people may drive the host via those webhooks.

Co-authored-by: omegent-app[bot] <306514130+omegent-app[bot]@users.noreply.github.com>
Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>

The header said claims were a process-local Ref with "Persistence later".
`layerPersisted` has since made server claims SQLite-backed
(SessionIdentityClaimRepository + migration 037), with the Ref demoted to a
read-through cache. Only the residual-free `layer` used by the CLI and tests
is still memory-only.

Co-authored-by: T3 Code PR Stack <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

The server read T3_IDENTITY_MAP_PATH once at layer construction, so adding or
removing a person meant restarting t3code-server. The map is now re-checked on
a 60s TTL and applies in place.

Polls rather than watches: the map arrives over virtiofs from the host, where
inotify propagation is not something to depend on. An ino/size/mtime
fingerprint keeps an untouched file from being re-parsed every TTL.

Two safety rules, because a reload can now fail in production where startup
could not:

- A re-read that yields no people never disables an already-enabled map.
  `enabled === false` turns the operate gate off entirely, so a truncated or
  unparseable file would have failed open. The last good map keeps serving,
  marked unhealthy, and the next TTL retries.
- requireOperateClaim no longer deletes the persisted claim of a person who is
  absent from the map. A half-written file can still parse as a valid map with
  a subset of people, and that delete is not reversible. Refusing operate is
  the gate; membership is re-checked on every operate, so a stale row grants
  nothing.

Startup behaviour is unchanged: a missing or empty map still means the feature
is off, and removing T3_IDENTITY_MAP_PATH remains the way to disable the gate.

Co-authored-by: T3 Code PR Stack <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>