Stability remainder: browser automation limits, provider usage, single-instance arbitration, CI release pipeline

[arzafran]

What this does

One consolidated stability batch so everything ships from a single CI run and build. It supersedes #318 (single-instance arbitration, merged in verbatim) and #321 (provider usage popover fix, merged in verbatim).

User-visible changes, from CHANGELOG:

• Provider usage popover reads Claude and Codex again instead of reporting both "could not be read"; a signed-out Claude hides its card; footer icons sit slightly wider.
• Launching two copies of Programa at nearly the same time keeps the newer instance instead of both terminating each other.
• Escape cancels in-progress IME input (Japanese, Chinese, Korean) even while the command palette is opening or just closed.
• Cmd+D confirms only the close alert in the window that received it.
• Browser automation reuses element refs within a page, bounds ref counts, selector bytes, DOM visits and snapshot payload fields, preserves state across tab transfers, and finalizes failed transfers or closed tabs, workspaces and windows exactly once.
• A documentation-only commit on main can no longer strand the latest green build; it now starts CI and can drive the release pipeline.

Also in here: CLI hook and output-size hardening, session escrow and closed-terminal undo cleanup, mobile bridge session changes, review diff prober bounds, socket control settings, release scripts (rolling release state, milestone payload, Sparkle monotonic guard, create-dmg pinning) with their shell and JS tests.

Review order

1. Sources/TerminalController+BrowserAutomation.swift and Sources/TerminalController.swift (limits block). Largest diff; merged against fix: make browser state restore transactional #317 on main, with main's encodeDocument, DataStoreLeaseState, and storage-mutation fencing kept.
2. Sources/AppDelegate.swift: arbitration is fix: arbitrate simultaneous app launches #318's version; the branch's earlier draft was dropped.
3. Sources/ClaudeQuotaMonitor.swift: ProviderUsagePipeReader replaces FileHandle.bytes.
4. .github/workflows/*.yml and scripts/: release pipeline changes.
5. Everything else.

Test plan

• PR CI green (unit, socket integration, UI regressions, compat)
• Open the sidebar usage popover with Claude and Codex signed in: both cards render within about a second
• Launch the app twice in quick succession: exactly one instance survives
• Rolling release from the next green main run publishes with a monotonic build number