feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

server/lib/git-ops.js

@@ -390,11 +390,14 @@ async function runGitAction(dir, action, body = {}) {
     if (target.code === "??") {
       throw bad("EUNTRACKED", "an untracked file has no hunks; stage or discard the whole file");
     }
+    // `block` (optional) picks one change block inside the hunk (#50). It is
+    // an index into git's own fresh text, never text from the request.
     const patch = await hunkPatch(
       dir,
       target.path,
       typeof body.hunk === "string" ? body.hunk : "",
-      body.context
+      body.context,
+      body.block === undefined ? {} : { block: body.block, reverse: action === "discard-hunk" }
     );
     if (!patch) throw bad("EHUNKGONE", "that change is no longer in the diff; refresh and retry");
     // The patch names paths from the repo root, so it is applied there.