fix(macos): scrub parent-session env, survive node upgrades and reboots, store lanes by real path (#22)

What broke (code audit, untested on a Mac):
- Without systemd the server is always spawned from inside a Claude Code
  session, so it inherited CLAUDECODE, CLAUDE_CODE_SESSION_ID,
  CLAUDE_PLUGIN_ROOT, ... and tmux handed them to every lane pane (a codex
  pane even resolved as `claude` in `agenthub`'s harness check).
- The ~/.local/bin/agenthub launcher pinned a versioned node path that
  `brew upgrade`/nvm deletes, leaving the CLI dead until the next bootstrap.
- A discovery entry left over from before a reboot could name a recycled pid,
  so the bootstrap's fast path believed a dashboard was live and
  stopDashboard could signal an unrelated process.
- Lanes were stored under the typed cwd; macOS reports /private/tmp and the
  on-disk case, so sessions never bound to a /tmp or differently-cased lane.

What changed:
- server/index.js deletes a DENYLIST of parent-session variables at startup;
  user config (CLAUDE_CONFIG_DIR, CLAUDE_CODE_USE_BEDROCK, ANTHROPIC_*) stays.
- linkCli's launcher falls back to `node` on PATH when the pinned one is gone.
- liveServers ignores entries whose startedAt predates this boot (60 s margin).
- createLane and POST /api/lanes/ensure store/look up fs.realpathSync.native
  of an existing cwd; the liveness reaper also tries the realpath. Existing
  rows are untouched.
- session-liveness gains an exec seam so the darwin ps+lsof branch is tested.
- plugin-doctor names ~/.zshrc on darwin; INSTALL.md gains a macOS section
  with the Mac verification checklist, mirrored in both READMEs and PLUGINS.md.
No launchd, no macOptionIsMeta, engines stays >=20.

server/__tests__/session-liveness.test.js

@@ -393,3 +393,55 @@ describe("watchdog liveness reap", () => {
     assert.equal(stmts.getSession.get(sid).status, "completed");
   });
 });
+
+describe("probeLiveCwds — darwin branch (ps + lsof, stubbed)", () => {
+  const realPlatform = process.platform;
+  const PS =
+    "  101 /opt/homebrew/bin/claude --resume x\n  102 node /Users/x/claude-dashboard/index.js\n  103 claude\n";
+  const LSOF = "p101\nfcwd\nn/Users/x/proj\np103\nfcwd\nn/private/tmp/other\n";
+  let calls;
+
+  beforeEach(() => {
+    delete process.env.DASHBOARD_LIVENESS_PROBE;
+    process.env.AGENTHUB_FORCE_HOST = "1";
+    Object.defineProperty(process, "platform", { value: "darwin", configurable: true });
+    calls = [];
+  });
+  after(() => {
+    Object.defineProperty(process, "platform", { value: realPlatform, configurable: true });
+    liveness.__setExecImpl(null);
+    delete process.env.AGENTHUB_FORCE_HOST;
+    process.env.DASHBOARD_LIVENESS_PROBE = "0";
+  });
+
+  it("reads each claude pid's cwd from lsof -Fn records", () => {
+    liveness.__setExecImpl((bin, args) => {
+      calls.push([bin, args]);
+      return bin === "ps" ? PS : LSOF;
+    });
+    const r = realProbe();
+    assert.equal(r.available, true);
+    assert.deepEqual([...r.cwds].sort(), ["/Users/x/proj", "/private/tmp/other"]);
+    assert.deepEqual(calls[1], ["lsof", ["-a", "-p", "101,103", "-d", "cwd", "-Fn"]]);
+  });
+
+  it("keeps lsof's partial output when it exits 1 because a pid vanished", () => {
+    liveness.__setExecImpl((bin) => {
+      if (bin === "ps") return PS;
+      const err = new Error("exit 1");
+      err.stdout = "p101\nfcwd\nn/Users/x/proj\n";
+      throw err;
+    });
+    const r = realProbe();
+    assert.equal(r.available, true);
+    assert.deepEqual([...r.cwds], ["/Users/x/proj"]);
+  });
+
+  it("reports unavailable when lsof fails with no output", () => {
+    liveness.__setExecImpl((bin) => {
+      if (bin === "ps") return PS;
+      throw Object.assign(new Error("ENOENT"), { stdout: "" });
+    });
+    assert.equal(realProbe().available, false);
+  });
+});