feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

server/index.js

@@ -480,9 +480,22 @@ function startBackgroundServices() {
   } catch (err) {
     console.warn("workflow poll failed to start:", err.message);
   }
-  // Codex lane stage detection. Codex emits no hooks at all, so its rollout
-  // journals on disk are the only signal a `codex` lane is working — without
-  // this poll such a lane's pipeline map never moves. `broadcastLane` (not the
+  // Codex lanes carry no pipeline. Older builds inferred one and wrote a stage
+  // block into their AGENTS.md; take both back out. Idempotent, every start.
+  try {
+    const lanesLib = require("./lib/lanes");
+    const { removeStageDoc } = require("./lib/lane-agents");
+    const wiped = lanesLib.clearCodexPipelines();
+    if (wiped > 0) console.log(`Cleared leftover pipeline data from ${wiped} codex lane(s)`);
+    for (const lane of lanesLib.listLanes().filter((l) => l.tool === "codex")) {
+      if (removeStageDoc(lane.cwd))
+        console.log(`Removed the AgentHub stage block from ${lane.cwd}/AGENTS.md`);
+    }
+  } catch (err) {
+    console.warn("codex pipeline cleanup failed:", err.message);
+  }
+  // Codex lane status. Codex emits no hooks at all, so its rollout journals on
+  // disk are the only signal a `codex` lane is working. `broadcastLane` (not the
   // bare `broadcast(type, data)` above) is the single-lane push the hook route
   // uses.
   try {
@@ -491,15 +504,6 @@ function startBackgroundServices() {
   } catch (err) {
     console.warn("codex poll failed to start:", err.message);
   }
-  // Safety net: a codex lane only declares stage when the session calls
-  // `agenthub stage` itself. When auto-detection has clearly moved on without a
-  // matching declaration, nudge the session's own pane to make the real call
-  // — never writes stage itself, so the declared-wins invariant is untouched.
-  try {
-    require("./lib/codex-nudge").startCodexNudge();
-  } catch (err) {
-    console.warn("codex nudge failed to start:", err.message);
-  }
   // Continuous discovery of sessions under ~/.claude/projects. The one-time
   // legacy backfill above runs only once (marker-gated), so a project added
   // later whose sessions never flow through hooks would otherwise stay invisible