fix(git,macos,runs): close the review findings on #22, #34 and #38

- validateRemoteUrl checks the literal scheme prefix git will receive and
  refuses %/backslash in the authority (WHATWG normalises https:/host and
  percent-escapes that git reads differently); route test for EBADURL.
- Parent-session scrub also drops AI_AGENT, and GIT_EDITOR when it is
  Claude Code's `true`.
- canonicalCwd resolves a not-yet-existing path through its deepest
  existing ancestor, so a symlinked parent still yields one lane.
- Note the clock-step ceiling on liveServers' boot-time filter.
- Docs/header wording: the Active runs count is lane-scoped.

server/lib/git-ops.js

@@ -117,6 +117,13 @@ function validateRemoteUrl(url) {
   // eslint-disable-next-line no-control-regex
   if (/[\s\x00-\x1f\x7f]/.test(url) || url.startsWith("-")) throw refuse();
   if (SCP_LIKE.test(url)) return url;
+  // WHATWG is more forgiving than git: it reads `https:host/x` or `https:\\host`
+  // as https://host/x, where git sees no "://" and dials an ssh host named
+  // "https". So the scheme must be spelled out literally, and the authority
+  // may carry no `%` (git decodes `%2D` into the leading "-" refused below)
+  // and no backslash — the string checked is the string git gets.
+  const scheme = ["https://", "ssh://"].find((p) => url.startsWith(p));
+  if (!scheme || /[%\\]/.test(url.slice(scheme.length).split("/")[0])) throw refuse();
   let parsed;
   try {
     parsed = new URL(url);

server/lib/lanes.js

@@ -171,10 +171,17 @@ function canonicalCwd(cwd) {
   // A relative path must stay relative, so createLane still refuses it.
   if (!cwd.startsWith("/")) return cwd;
   const trimmed = cwd.replace(/\/+$/, "");
-  try {
-    return require("node:fs").realpathSync.native(trimmed);
-  } catch {
-    return trimmed;
+  // A path that does not exist yet resolves through its deepest existing
+  // ancestor, so /link/new and /real/new still name the same lane.
+  const path = require("node:path");
+  const tail = [];
+  for (let dir = trimmed; ; dir = path.dirname(dir)) {
+    try {
+      return path.join(require("node:fs").realpathSync.native(dir || "/"), ...tail);
+    } catch {
+      if (dir === "/" || !dir) return trimmed;
+      tail.unshift(path.basename(dir));
+    }
   }
 }