feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

server/README.md

@@ -584,30 +584,12 @@ pipeline's last node, where the pipeline is finished and a later detection is
 new work — and, the one rule that matters, never counts as evidence and never
 renders a node as `done` (see `docs/LANES.md#stage-detection`).
 
-A `codex` lane has no hooks to read, so `server/lib/codex-ingest.js` feeds the
-same matcher from Codex's own rollout journals under
-`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
-`DASHBOARD_CODEX_POLL_MS` ms (default 15000, `0` disables) and mapping Codex's
-tool calls onto the `{tool_name, tool_input}` shape a hook delivers. The same
-pass mirrors that lane's `status` between `idle` and `running` from the
-journal's mtime, under the guard hook ingestion uses (no `run_id`, only from
-`idle`/`running`); it writes nothing else.
-
-Getting a codex lane's *declared* stage to actually happen is a separate
-problem — only the session itself can call `agenthub stage`, and unlike a Claude
-lane it has no slash command to pre-fill — and the run console pre-fills
-nothing into the prompt box any more, for either tool, since anything sitting
-there is sent as a real prompt on start. What is left is
-`server/lib/codex-nudge.js`'s `sweepCodexNudges()` runs on an unref'd 60s
-interval (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables): when a codex lane's fresh
-`detected_stage` has sat ahead of its declared `stage` for at least two
-minutes, it types a one-line `[agenthub] ... run: agenthub stage ...` reminder into
-the lane's live tmux pane via `tmux.sendText` — skipped if the pane sits at a
-bare shell prompt (`pty-run.js`'s `SHELL_COMMANDS`), since pressing Enter there
-would run the reminder as a shell command instead of submitting it to Codex.
-It never writes `stage` or `detected_stage`, so declared-wins and
-inferred-never-`done` are untouched; any resulting declaration is still the
-codex session's own real `agenthub stage` call.
+A `codex` lane has no hooks to read and carries no pipeline, so nothing detects
+or advances its stage. `server/lib/codex-ingest.js` only mirrors its `status`
+between `idle` and `running` from the mtime of Codex's own rollout journals
+under `$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
+`DASHBOARD_CODEX_POLL_MS` ms (default 15000, `0` disables), under the guard hook
+ingestion uses (no `run_id`, only from `idle`/`running`); it writes nothing else.
 
 ### Remote Data Sources