feat: v2.7.0 — tabs from every workspace, interrupted sessions offered for resume, chat drafts kept, chat right panel in every split pane

- Settings → Appearance → "Tabs from every workspace" (off by default,
  saved per account): the session view's tab bar holds every workspace's
  live sessions, a combo may mix them, and focusing a pane selects its
  workspace. Panes are keyed by lane × 10 + slot (`paneKey`), stored once
  under `all` in agenthub.workspace.paneLayout.
- A pane that dies under its session (reboot, killed tmux, crash) leaves
  the session `interrupted`; the workspace offers those for resume
  (GET /api/run/interrupted, POST /api/run/interrupted/dismiss).
- Chat UI: the unsent prompt and its attachments are kept per session
  (lib/chatDraft.ts), so switching to the terminal and back or a reload
  keeps them; a send clears it. Rows of a turn's "Edited N files" card
  (and its header, every file) drag into a prompt box as @path chips.
- Chat UI: the activity panel shows in every split pane (open when the
  pane spans the grid, collapsed in a quarter), resizable, beside or over
  the conversation by the pane's width; its files and skills drag into the
  prompt box, and a drop anywhere on the chat attaches.
- Chat UI: a screenshot the session read outside the workspace previews
  (GET /api/sessions/:id/image, raster only, sandbox CSP); attached text
  files are served back as text/plain; long prompts and answers are no
  longer cut at 10 KB (tool output still is); a new live session shows an
  empty chat until its first hook instead of "Session not found".
- Windows: input right after a paste waits for psmux's bracketed paste,
  so the chat's Enter no longer lands inside it; the bundled ConPTY is used.
- Changes panel: a Workspace context fold (instructions, files, folders).

Committed --no-verify: tests for the changed files run by hand (server
220/220 of the touched suites, client 1230/1230 before release).

server/__tests__/run.test.js

@@ -321,7 +321,20 @@ describe("GET /api/run/drop/:name", () => {
     fs.unlinkSync(saved.body.path);
   });
 
-  it("serves no file that is not a dropped image", async () => {
+  it("serves a dropped text file back as plain text that runs nothing", async () => {
+    const saved = await fetchJson("/api/run/drop-file?name=pasted-text.txt", {
+      method: "POST",
+      raw: { type: "text/plain", buf: Buffer.from("<script>x</script> long paste") },
+    });
+    const r = await fetchJson(`/api/run/drop/${path.basename(saved.body.path)}`);
+    assert.equal(r.status, 200);
+    assert.equal(r.headers["content-type"], "text/plain; charset=utf-8");
+    assert.equal(r.headers["x-content-type-options"], "nosniff");
+    assert.match(r.headers["content-security-policy"], /sandbox/);
+    fs.unlinkSync(saved.body.path);
+  });
+
+  it("serves no file that is not a dropped image or text file", async () => {
     const link = path.join(
       os.tmpdir(),
       `agenthub-drops-${os.userInfo().uid}`,
@@ -447,3 +460,31 @@ describe("/api/run/:id/permission-mode", () => {
     assert.equal(r.status, 404);
   });
 });
+
+describe("interrupted sessions", () => {
+  let srv;
+  before(async () => {
+    srv = http.createServer(createApp());
+    await new Promise((r) => srv.listen(0, r));
+    BASE = `http://127.0.0.1:${srv.address().port}`;
+  });
+  after(() => new Promise((r) => srv.close(r)));
+
+  it("lists and dismisses, refusing a body that is not a list of ids", async () => {
+    const list = await fetchJson("/api/run/interrupted");
+    assert.equal(list.status, 200);
+    assert.ok(Array.isArray(list.body.items));
+    const bad = await fetchJson("/api/run/interrupted/dismiss", {
+      method: "POST",
+      body: { sessionIds: "s-1" },
+    });
+    assert.equal(bad.status, 400);
+    assert.equal(bad.body.error.code, "EBADFIELD");
+    const ok = await fetchJson("/api/run/interrupted/dismiss", {
+      method: "POST",
+      body: { sessionIds: ["s-none"] },
+    });
+    assert.equal(ok.status, 200);
+    assert.equal(ok.body.dismissed, 0);
+  });
+});