fix: provider usage popover reads Claude and Codex again

[arzafran]

What this does

Opening the sidebar Provider Usage popover showed "Claude usage could not be read" and "Codex usage could not be read" for both providers, even with both CLIs signed in. Both now load in under a second. A signed-out Claude CLI hides the provider instead of showing an error, and the help and usage icons in the sidebar footer sit a little further apart.

Why it broke

codex app-server keeps running after it answers, and its stderr stays silent. The fetcher drained that stderr pipe through FileHandle.bytes, whose reads go through one shared Foundation IO actor. The blocked stderr read starved the stdout reader, and because the Claude probe runs at the same time, its auth status read starved too. Both probes hit the 5 second deadline together. Reproduced in a standalone harness and in-process (a child's stdout lines arrived only at process exit).

The fix reads pipes through readabilityHandler instead, and sends the app server's stderr to the null device. claude auth status also exits 1 when signed out while still printing {"loggedIn": false}; the fetcher now trusts the parsed answer over the exit status.

Review order

1. Sources/ClaudeQuotaMonitor.swift: ProviderUsagePipeReader, the Claude reader, the Codex runner.
2. programaTests/ClaudeQuotaSnapshotParserTests.swift: the three new tests and the lingerAfterResponses fake.
3. Sources/SidebarVisuals.swift: one constant.

Test plan

• First commit alone fails testLongLivedServerWithAnIdleStderrPipeDoesNotStallTheResponseReader and testSignedOutClaudeCLIExitStatusStillHidesTheProviderInsteadOfFailing in CI (verified locally against the pre-fix source)
• Full PR CI green
• On a build of this branch, open the sidebar usage popover with Claude and Codex signed in: both cards render with percentages within about a second

[arzafran]

Superseded by #322, which carries these three commits unchanged.