feat: v2.7.8 — Artifacts hub, clone related repos as extra folders, quieter resume prompt

- Artifacts (/artifacts): claude.ai pages sessions publish (captured from the
  Artifact tool's hook), pinned workspace files, skills and plugins, each
  kept as a snapshot; shared ones appear in a Hub and a skill or plugin
  installs into the viewer's own account (server/lib/artifacts.js,
  /api/artifacts, docs/plans/artifacts/).
- Workspace extra folders: clone one or more related repos beside the
  workspace and add them in one step (POST /api/lanes/:id/sources/clone).
- A pane that ended by itself while tmux kept running is no longer offered
  for resume (tmux.serverStartedAt in reconcileOrphans).
- Changes panel: a folder that is not a git repo opens on Files, and its
  files open from there.
- Plus the parallel sessions' work in this tree: File Explorer button in the
  panel header, user delete, RSA SSH keys, chat/terminal and pet fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/scope.js

@@ -154,6 +154,11 @@ const PATH_RULES = [
   [/^\/workflows\/session\/([^/]+)/i, (req, m) => canSeeSession(req, m[1])],
   [/^\/workflows\/runs\/([^/]+)/i, (req, m) => canSeeRowSession(req, "workflows", m[1], "run_id")],
   [/^\/alerts\/([^/]+)\/ack/i, (req, m) => canSeeRowSession(req, "alert_events", m[1])],
+  // `/artifacts/<id>…`: the owner's, or a shared one (server/lib/artifacts.js).
+  [
+    /^\/artifacts\/(\d+)(?:\/|$)/i,
+    (req, m) => require("./artifacts").canSeeId(req, m[1]),
+  ],
   [
     /^\/snapshots\/([^/]+)$/i,
     (req, m) => req.method !== "DELETE" || canSeeRowSession(req, "session_snapshots", m[1]),
@@ -296,6 +301,9 @@ function broadcastAudience(type, data) {
     case "lane_hook_result":
     case "lane_runtime":
       return { owners: laneOwners(d.laneId) };
+    // A shared artifact is everyone's news; a private one, its owner's.
+    case "artifact_changed":
+      return d.shared ? null : { owners: new Set(d.ownerId != null ? [d.ownerId] : []) };
     case "update_status":
     // No payload: each client refetches its own `GET /api/run/interrupted`.
     case "runs_interrupted":