feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

docs/PLUGINS.md

@@ -106,9 +106,8 @@ root holds all four (`qc-local`, `senior-gate-reviewer`, `backend-reviewer`,
 `.claude/agents/` — the highest-priority agent source — which is what makes the
 bare `subagent_type: qc-local` in the pipeline skill resolve there. One source
 file, two ways to reach it; the skill names the bare form first and falls back
-to the `agenthub:` form. On a `codex` lane the same command installs the
-`<!-- agenthub:stage:start -->` block in the lane's `AGENTS.md` instead — Codex
-never reads `.claude/agents/`.
+to the `agenthub:` form. On a `codex` lane the same command installs nothing —
+Codex never reads `.claude/agents/`, and codex lanes carry no pipeline.
 
 Because the plugin ships the hooks itself, `npm run install-hooks` is not needed
 for plugin users — and must not be run alongside it. Events carry no id, so two
@@ -137,10 +136,11 @@ waits on an install:
 7. **CLI** — write the `~/.local/bin/agenthub` launcher, never clobbering a `agenthub` the bootstrap did not write. It pins the node that ran the bootstrap and falls back to `node` on `PATH` when that binary is gone (a Homebrew Cellar or nvm path deleted by an upgrade).
 8. **UI build** — `client/` is copied into the runtime dir and built there (`npm ci --include=dev`, falling back to `npm install --include=dev`, then `npm run build`), landing in `runtime/client-dist` — the same directory the server serves from. `--include=dev` is required, not tidy: the entire build toolchain (`vite`, `typescript`, `@vitejs/plugin-react`, `tailwindcss`, `@types/*`) is a devDependency, and npm reads an inherited `NODE_ENV=production` as `--omit=dev`. Every bootstrap descended from the running server carries that env — the self-update chain, and any `SessionStart` fired by a `claude` inside a tmux pane the server started — so without the flag the install drops `vite` and the build dies on missing types. Skipped when a bundle for the current version already exists; a failure here does not fail the bootstrap (the API still works, and `/agenthub-open` can retry) but does mean `/run` 404s until it's fixed — and when a bundle from the PREVIOUS version is still on disk the failure is quieter still: the dashboard keeps serving the old UI against the new API, visible only as the Settings page's `UI build vX (rebuild client to match)` line.
 9. **Server** — on Linux with `systemd --user` available, install/refresh a
-   `agenthub.service` unit (see [Auto-start on boot](#auto-start-on-boot)) instead
+   `agenthub.service` unit — on macOS with a GUI login, the
+   `io.smartgift.agenthub` LaunchAgent (see [Auto-start on boot](#auto-start-on-boot)) — instead
    of a bare spawn, so the server is supervised and comes back after a reboot
-   with no Claude Code session involved. Everywhere else (macOS, Windows, or
-   no systemd), spawn `server/index.js` detached, with `NODE_PATH` at the
+   with no Claude Code session involved. Everywhere else (Windows, no
+   systemd, a Mac reached only over SSH), spawn `server/index.js` detached, with `NODE_PATH` at the
    runtime `node_modules` and `DASHBOARD_CLIENT_DIST` at the runtime
    `client-dist` — scoped to this session, same as before this fell back to
    systemd.
@@ -233,15 +233,26 @@ anyone logs in; when that needs elevated rights, it's skipped silently (check
 `agenthub.service` unit not written by this bootstrap is left untouched, and the
 server falls back to the old per-session detached spawn instead.
 
-On macOS, Windows, or a Linux box without systemd, nothing changes: the
+On macOS the same steps write a LaunchAgent instead
+(`~/Library/LaunchAgents/io.smartgift.agenthub.plist`, `scripts/launchd-service.js`;
+`scripts/service-manager.js` picks the one for the platform, and both export the
+same API). `KeepAlive` plays `Restart=always`, `AbandonProcessGroup` keeps the
+lane panes' tmux server alive across a restart, output goes to
+`~/Library/Logs/agenthub.log`, and the hand-over restart is `launchctl bootout`
++ `bootstrap` (a `kickstart` would keep the old plist). If that bootstrap fails
+and no server is left running, the bootstrap starts one detached. A LaunchAgent
+needs the user's GUI login; without one (SSH only) `launchctl print gui/<uid>`
+fails and the server falls back to the detached spawn below.
+
+On Windows, a Linux box without systemd, or a Mac with no GUI login, the
 server is a detached spawn started fresh on the next `SessionStart` after a
 reboot, same as always. That spawn inherits the Claude Code session's env, so
 `server/index.js` deletes the parent-session variables (`CLAUDECODE`,
 `CLAUDE_CODE_SESSION_ID`, `CLAUDE_CODE_MESSAGING_*`, `CLAUDE_PLUGIN_ROOT`, …)
 before anything else runs — otherwise tmux hands them to every lane pane. It is
 a denylist: user configuration such as `CLAUDE_CONFIG_DIR`,
-`CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_*` passes through. There is no
-launchd agent; see [INSTALL.md § macOS](../INSTALL.md#macos).
+`CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_*` passes through. See
+[INSTALL.md § macOS](../INSTALL.md#macos).
 
 ### Who may stop the server