feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

README.md

@@ -78,7 +78,7 @@ Internal build — all rights reserved.
 | **Node.js** | >= 20 (>= 22.5 for a plugin install) | Everything. Both suites are verified green on **24** and **26** |
 | **npm** | 9+ | Ships with Node |
 | **git** | any | Cloning, and every lane operation (worktrees, branch/status reads) |
-| **tmux** | 3.x | The browser run console, `agenthub lanes shell`, typing `/reload-plugins` into a live pane, the Codex nudge |
+| **tmux** | 3.x | The browser run console, `agenthub lanes shell`, typing `/reload-plugins` into a live pane |
 | **Claude Code** | 2.x | Hook ingestion — the whole monitoring side |
 | **Codex CLI** | any | Optional — only for `codex` lanes |
 | **GitHub CLI (`gh`)** | any | Optional — only for `agenthub lanes ci status` and the PR stages of the ship pipelines |
@@ -193,19 +193,20 @@ every event is counted twice.
 ### Run as a service (auto-start on boot)
 
 `npm start` only runs while that terminal (or `agenthub start`'s background
-process) is alive — a reboot loses it. On Linux, `agenthub service install` sets
-up a systemd `--user` service instead, so `:4820` is up again on its own after
+process) is alive — a reboot loses it. `agenthub service install` sets up a
+systemd `--user` service (Linux) or a LaunchAgent (macOS) instead, so `:4820` is up again on its own after
 every reboot, with no manual step and no Claude Code (or any AI tool) needed
 to trigger it:
 
 ```bash
 npm run build              # the service serves the built client, same as npm start
-agenthub service install       # writes + enables ~/.config/systemd/user/agenthub.service
-agenthub service status        # systemctl --user status agenthub
+agenthub service install       # Linux: ~/.config/systemd/user/agenthub.service
+                               # macOS: ~/Library/LaunchAgents/io.smartgift.agenthub.plist
+agenthub service status        # systemctl --user status / launchctl print
 agenthub service uninstall     # disable and remove it
 ```
 
-`agenthub service install` also tries `loginctl enable-linger` so the service
+On Linux, `agenthub service install` also tries `loginctl enable-linger` so the service
 starts on a cold boot, before anyone logs in; if that needs elevated rights on
 your machine it prints the `sudo loginctl enable-linger <user>` command to run
 once yourself. Plugin installs get the same persistence automatically — see
@@ -252,20 +253,11 @@ Every lane also carries the CLI that drives it — `claude` (the default) or
 Codex lane's run panel offers Codex's own sandbox, approval and reasoning-effort
 choices, and resumes with `codex resume --last`. Codex emits none of this
 dashboard's hooks, so a Codex lane records its runs but stays absent from
-Sessions and Analytics. Its **stage detection** works anyway, from Codex's own
-rollout journals on disk (`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
-`DASHBOARD_CODEX_POLL_MS` ms, default 15000), and on a Codex lane a detection
-also **advances the declared stage** — the one place an inference moves the blue
-`current` ring, because a Codex session has no hook and nothing else would ever
-move it. What a Codex lane cannot get for free is *evidence*: an auto-advanced
-node stays amber (`passed-no-evidence`), never green, since only the session
-itself can say what it finished. Two things help it get there (the run console
-no longer pre-fills anything into the prompt box — that box is the user's to
-type): `agenthub lanes agents install` writes the stage-declaration
-instructions as a marker-delimited block in the lane's `AGENTS.md`, and a 60s
-sweep (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables) types a one-line reminder into
-a lane's pane if its current stage sits without evidence for more than two
-minutes.
+Sessions and Analytics. A Codex lane also carries **no pipeline** — no stage,
+no pipeline map, nothing inferred or advanced; the dashboard only mirrors its
+running/idle status from Codex's own rollout journals on disk
+(`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
+`DASHBOARD_CODEX_POLL_MS` ms, default 15000).
 
 The declared stage comes from `agenthub stage`. The inferred stage comes from tool
 events and expires after `DETECTION_TTL_MS` (default 5 minutes), so a lane can