chore: v2.8.23 — workspace groups, inner repos in Changes (opt-in), sub-agent tokens counted

Workspace groups: named, foldable, ordered sidebar sections kept per
account (agenthub.workspace.groups); a workspace joins one from its menu,
a drop on the header, a drag under a row, or Alt+Up/Down past a group's
edge; headers drag to reorder; a folded header shows its most urgent
state; New workspace in this group; fold/unfold all.

Inner repos: GET /api/lanes/:id/repos + ?repo= on git/fs routes; the
Changes panel shows a parent folder's repos only when Settings -> Git ->
Changes panel turns it on (agenthub.changes.innerRepos, off by default).

Cost: the hook writer adds a session's sub-agent transcripts to its
tokens and hours (server/lib/subagent-usage.js) — a sub-agent on the
session's own model was never counted live (~8% of a week here); an
imported session is re-raised on every pass, so a claude -p run first
seen with an empty transcript no longer stays at $0 (~10%). A one-time
raise-only catch-up (user_version 5) re-reads ~/.claude/projects.

Also: omp install script may redirect to its exact install.redirect URL
(#85, repo-links test exempts it), native paste in the terminal.

server/__tests__/ai-tools.test.js

@@ -261,6 +261,20 @@ describe("install/update fields and trust tiers", () => {
         update: { kind: "script" },
       })
     );
+    write(
+      tb,
+      "redir.json",
+      base("redir", {
+        install: { kind: "script", url: "https://example.com/i", redirect: "https://cdn.io/i.sh" },
+      })
+    );
+    write(
+      tb,
+      "badredir.json",
+      base("badredir", {
+        install: { kind: "script", url: "https://example.com/i", redirect: "http://cdn.io/i" },
+      })
+    );
     write(tb, "badpkg.json", base("badpkg", { install: { kind: "npm", package: "Bad Pkg;rm" } }));
     write(
       tb,
@@ -302,7 +316,8 @@ describe("install/update fields and trust tiers", () => {
       url: "https://example.com/install",
     });
     assert.deepEqual(aiTools.get("claude").update, { kind: "self", args: ["update"] });
-    for (const id of ["badpkg", "httpurl", "offhost", "npmnoinst", "selfbad"]) {
+    assert.equal(aiTools.get("redir").install.redirect, "https://cdn.io/i.sh");
+    for (const id of ["badpkg", "httpurl", "offhost", "badredir", "npmnoinst", "selfbad"]) {
       assert.equal(aiTools.has(id), false, id);
     }
   });