Add native Herdr integration (counterpart to native nest. TMUX)

[RaviTharuma]

Summary

Implements #8737 — native nested topology for Herdr-hosted agents (v1).

Ports the completed fork PR chain (RaviTharuma/cmux #1–#6) onto current manaflow-ai/cmux main.

Architecture

• Provider-neutral model (CmuxNestedTopology)
• Herdr Unix-socket adapter (no CLI)
• Secure attach (UID/mode/path identity, beta gate)
• Sidebar + control-socket projection
• Capability-gated focus
• Restore intent-only with identity revalidation

Non-goals

• No Bonsplit ownership of Herdr PTYs
• No shelling out to herdr CLI
• Not mixed with Add Herdr CLI compatibility shim (Step toward native Herdr ) #8736 (__herdr-compat MVP remains separate)

Testing

• swift test --package-path Packages/macOS/CmuxNestedTopology — 196 passed
• workspace package groups + pbxproj test wiring OK
• macOS dogfood: Beta → Nested Topology attach/focus/restore

Security notes

• Socket UID/mode/path identity checks; beta-gated
• No auto-reattach without provider/instance identity proof
• Persist attachment intent only (not live inner nodes)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Implements #8737 by adding a beta-gated native Herdr nested topology alongside nested tmux. cmux connects to Herdr’s local Unix socket, projects provider-owned workspaces, tabs, panes, and agents, and mirrors Herdr windows into real panels while leaving provider panes running when the host detaches.

New Features

• Adds a protocol-17 JSON-lines client with capability negotiation, bounded payloads, reconnect/resnapshot handling, ordered queues, and stable identity during pane resubscriptions.
• Adds nested topology listing and focus APIs plus secure attachment and restore checks, including socket ownership, permissions, path identity, and connected-peer validation.
• Supports Herdr focus, input, splits, resizing, closing, layouts with tile fallback, tab lifecycle, filtered output, duplicate tab IDs, and native/plugin writer and size handoff.
• Adds title locks, association files, pane-route cleanup, the curated remoteHerdrMirror Settings search entry, package documentation, macOS CI coverage, and tests.

Migration

• Control-socket callers of remote.herdr methods must pass the live host window ID.

^{Written for commit 2a8d047. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Added opt-in nested topology views for provider-owned workspaces, tabs, panes, and agents.
  • Added expandable sidebar subtrees with connection, stale-state, accessibility, and focus support.
  • Added control-socket methods for listing topology and focusing nested nodes.
  • Added secure connections, capability negotiation, reconnection, session restoration, and protected attachment handling.
  • Added remote Herdr session mirroring with pane input, output, splitting, resizing, focus, layouts, and window controls.
  • Added beta settings and English/Japanese localization.
• Documentation
  • Added comprehensive nested topology documentation.
• Tests
  • Added broad coverage for topology, connectivity, restoration, mirroring, rendering, and security.