feat(shortcuts): bindable New tab, Split pane right and Split pane down

.coderabbit.yaml

@@ -10,6 +10,9 @@ reviews:
   auto_review:
     enabled: true
     drafts: false
+    # Review once when a PR opens; ask again with `@coderabbitai review` before merging,
+    # so each push does not spend the per-developer review allowance.
+    auto_incremental_review: false
   path_filters:
     - '!shared/herdr-api.generated.ts'
     - '!docs/screenshots/**'

.github/REVIEW.md

@@ -20,13 +20,20 @@ AI review is advisory; CI and maintainer review determine whether a PR can merge
 - A malformed VAPID file must fail without rotating the key. The service worker must
   show a notification for every push, including while the app is visible.
 - Preserve IME and native clipboard input. Use existing theme tokens for component CSS.
+- The `conventions.test.ts` baselines only shrink, and CI's shallow checkout cannot compare them
+  with main: flag a PR that raises a count in `scripts/fixed-sleeps.json` (a rename moves its entry
+  with the same count) or adds an allowlist entry (DEMO_404, DEMO_IGNORES, UNIX_CONNECT_ALLOWED,
+  NET_CONNECT_ALLOWED) without a reason that holds.
 - Installed updaters discover Git tags immediately. Release only the exact commit
   that passed CI; never create the release tag as a prerequisite for validation.
 - External contributors' PRs get the same priority and the same bar as maintainers'
   own: review them when they arrive and consider them for the next release. Approve
   their CI runs only after reading everything CI executes: workflows, scripts, tests,
   `package.json` scripts and dependency changes. Workflows must keep read-only PR
-  permissions and never add a `pull_request_target` trigger.
+  permissions and never add a `pull_request_target` trigger. Never approve the run of a fork PR
+  that changes `runs-on`, adds self-hosted labels, or edits `.github/actions/` or
+  `scripts/ci-runner-route.sh`: a self-hosted runner executes an approved fork workflow only if a
+  workflow routes it there.
 
 [CONTRIBUTING.md](../CONTRIBUTING.md) is the process contributors follow. The
 [AGENTS.md](../AGENTS.md) files give these invariants with their reasons and the conventions

.github/actions/setup-ci/action.yml

@@ -0,0 +1,66 @@
+name: Set up CI toolchain
+description: Bun (with its dependency cache), and optionally Node 22 and the checksum-pinned herdr. Callers check out the repository first.
+inputs:
+  bun-version:
+    description: Bun version for ci.yml, pages.yml and release.yml; the one place it is set.
+    required: false
+    default: '1.4.2'
+  node:
+    description: "'true' installs Node 22 (the PTY sidecar runs on it)."
+    required: false
+    default: 'false'
+  herdr:
+    description: "'true' installs the checksum-pinned herdr 0.9.3 (Linux x86_64) on PATH."
+    required: false
+    default: 'false'
+runs:
+  using: composite
+  steps:
+    # Keep cached files inside the checkout. Home-directory archives contain relative paths
+    # that cannot be restored between GitHub's workspace and the image's shorter /w path.
+    - name: Select workspace-local Bun cache
+      shell: bash
+      env:
+        BUN_CACHE_DIR: ${{ github.workspace }}/.ci-cache/bun
+      run: printf 'BUN_INSTALL_CACHE_DIR=%s\n' "$BUN_CACHE_DIR" >> "$GITHUB_ENV"
+    - name: Select workspace-local hosted browser cache
+      if: runner.environment != 'self-hosted'
+      shell: bash
+      env:
+        BROWSER_CACHE_DIR: ${{ github.workspace }}/.ci-cache/playwright
+      run: printf 'PLAYWRIGHT_BROWSERS_PATH=%s\n' "$BROWSER_CACHE_DIR" >> "$GITHUB_ENV"
+    - name: Verify prepared self-hosted tools
+      if: runner.environment == 'self-hosted'
+      shell: bash
+      env:
+        EXPECTED_BUN_VERSION: ${{ inputs.bun-version }}
+        NEED_NODE: ${{ inputs.node }}
+        NEED_HERDR: ${{ inputs.herdr }}
+      run: bash scripts/ci-preinstalled-tools.sh
+    - uses: oven-sh/setup-bun@v2
+      if: runner.environment != 'self-hosted'
+      with:
+        bun-version: ${{ inputs.bun-version }}
+    - if: inputs.node == 'true' && runner.environment != 'self-hosted'
+      uses: actions/setup-node@v7
+      with:
+        node-version: '22'
+    - name: Cache Bun dependencies
+      # On the measured self-hosted connection this archive costs 37–43s to restore,
+      # versus 7–20s for a fresh install. Do not pay for restore/save on disposable runners.
+      if: runner.environment != 'self-hosted'
+      uses: actions/cache@v4
+      with:
+        path: .ci-cache/bun
+        key: bun-workspace-v2-${{ runner.environment }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.bun-version }}-${{ hashFiles('bun.lock') }}
+        restore-keys: |
+          bun-workspace-v2-${{ runner.environment }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.bun-version }}-
+    - name: Install checksum-pinned herdr 0.9.3
+      if: inputs.herdr == 'true' && runner.environment != 'self-hosted'
+      shell: bash
+      run: |
+        mkdir -p "$RUNNER_TEMP/herdr-bin"
+        curl --fail --location --retry 3 https://github.com/herdrdev/herdr/releases/download/v0.9.3/herdr-linux-x86_64 -o "$RUNNER_TEMP/herdr-bin/herdr"
+        echo "18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7  $RUNNER_TEMP/herdr-bin/herdr" | sha256sum --check
+        chmod +x "$RUNNER_TEMP/herdr-bin/herdr"
+        echo "$RUNNER_TEMP/herdr-bin" >> "$GITHUB_PATH"

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-<!-- See CONTRIBUTING.md for checks, translations, contract tests and the changelog. -->
+<!-- See CONTRIBUTING.md for checks, translations, contract tests and the changelog (a file in changelog.d/, never CHANGELOG.md). -->
 
 ## Change