fix(git,macos,runs): close the review findings on #22, #34 and #38

- validateRemoteUrl checks the literal scheme prefix git will receive and
  refuses %/backslash in the authority (WHATWG normalises https:/host and
  percent-escapes that git reads differently); route test for EBADURL.
- Parent-session scrub also drops AI_AGENT, and GIT_EDITOR when it is
  Claude Code's `true`.
- canonicalCwd resolves a not-yet-existing path through its deepest
  existing ancestor, so a symlinked parent still yields one lane.
- Note the clock-step ceiling on liveServers' boot-time filter.
- Docs/header wording: the Active runs count is lane-scoped.

server/index.js

@@ -12,10 +12,13 @@ if (!process.env.NODE_ENV) process.env.NODE_ENV = "production";
 // (CLAUDE_CONFIG_DIR, CLAUDE_CODE_USE_BEDROCK, ANTHROPIC_*) passes through;
 // it must grow when Claude Code adds a new per-session variable.
 const PARENT_SESSION_VARS =
-  /^(CLAUDECODE|CLAUDE_PID|CLAUDE_PROJECT_DIR|CLAUDE_ENV_FILE|CLAUDE_PLUGIN_(ROOT|DATA)|CLAUDE_CODE_(ENTRYPOINT|SESSION_ID|CHILD_SESSION|SESSION_ATTENDED|EXECPATH|MESSAGING_.*))$/;
+  /^(CLAUDECODE|AI_AGENT|CLAUDE_PID|CLAUDE_PROJECT_DIR|CLAUDE_ENV_FILE|CLAUDE_PLUGIN_(ROOT|DATA)|CLAUDE_CODE_(ENTRYPOINT|SESSION_ID|CHILD_SESSION|SESSION_ATTENDED|EXECPATH|MESSAGING_.*))$/;
 for (const k of Object.keys(process.env)) {
   if (PARENT_SESSION_VARS.test(k)) delete process.env[k];
 }
+// Claude Code sets GIT_EDITOR=true so its own commits never block; a user's
+// real editor setting is anything else and stays.
+if (process.env.GIT_EDITOR === "true") delete process.env.GIT_EDITOR;
 
 // Load .env file (simple key=value, no external dependency needed)
 (function loadDotEnv() {