Use kwt's dedicated tmux server for managed workspaces

[wesm]

Managed workspaces now open through the pinned kwt helper on its dedicated tmux -L kwt server. Ghosthub follows kwt's explicit attachment mode instead of treating every named socket as protected.

• Direct worktrees and directories use kwt open; protected pull-request imports continue to use kwt pr attach. A same-named session on the default tmux server remains separate.
• Attachment, restoration, reconnect, and removal keep the exact mode and socket. An unresolved protected endpoint remains protected and requires fresh confirmation instead of inheriting a stale socket.
• Pins kwt to d818907f61dd1111415dfa6bbb86a41a513dd71b and updates the machine-readable contract and documentation for the required tmux_attach_mode field.
• Makes the Swift Testing lane honor its intended serial execution and replaces scheduler-dependent cancellation waits with observable events. Tailscale username discovery now rejects results that arrive after its overall deadline.

The pinned helper contract passes against the bundled binary. The 1,898-test Swift suite passed four serial runs, including one against the exact committed history.

[roborev-ci]

roborev: Combined Review (2e6c713)

Verdict: High-risk compatibility gaps remain for kwt attachment-mode parsing and endpoint-aware session handling.

High

• KWT_REVISION:1, rust/host/src/kwt.rs:197-209 — The new tmux_attach_mode field is rejected by Rust DTOs using deny_unknown_fields, causing valid kwt output to fail during Rust/WSL inventory and pull-request import parsing. Rust also treats every socket as protected, misclassifying direct kwt endpoints. Update DTOs, parsing, routing, fixtures, and coverage to honor the explicit attachment mode.

Medium

• Sources/App/WorkspaceWindowState.swift:610-625 — Restoration only probes named sockets for .protected worktrees. Direct worktrees using kwt’s named server fall back to default-server discovery and can leave persisted windows pending. Probe every named endpoint exactly; use default-server discovery only when no socket is specified.

• Sources/UI/WorkspaceSidebarModel.swift:434-450, 611-623 — Direct named kwt workspaces are checked only against default-server sessions, so live indicators and standalone kill eligibility remain incorrect. Use endpoint-aware presentation and exact live-session probes.

• Sources/App/WorkspaceSceneModel.swift:7645-7646, TmuxAttachmentInfo.swift:248-255 — Socket-less protected worktrees are incorrectly treated as default-server sessions. Always Live, attach-only, reconnect, and probe paths can silently redirect them to a same-named default-server session. Use attachment mode rather than socket presence for discovery, recovery, preview, styling, and kill decisions; keep unresolved protected endpoints pending or route them through kwt’s protected attach flow.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 14m8s