feat: v0.8.2 clickable paths, alert sessions, ops guard and trail

- Terminal link provider: printed paths that are files of the session open
  in Files (at the line); the file list is preloaded so the first hover works.
- Alerts: "In a new session" opens alert-<name> and types the prompt once
  Claude is up.
- devdesk-guard PreToolUse(Bash) hook: permissionDecision "ask" for
  destructive commands (verified to prompt in auto mode); DEVDESK_GUARD and
  guard.local.
- State hook logs Bash commands and derives host tags (ssh targets, CT/VM
  ids); --list carries tags, --peek the last commands; UI shows both.

Closes #21
Closes #18
Closes #27

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/protocol.test.mjs

@@ -86,3 +86,15 @@ test('untrusted text loses control characters before it is typed (#2)', () => {
   assert.equal(pasteSafe('plain text'), 'plain text');
   assert.equal(pasteSafe(null), '');
 });
+
+test('file paths in terminal output are found, URLs and plain words are not (#21)', async () => {
+  const { findPaths } = await import('../web/src/links.js');
+  const paths = (text) => findPaths(text).map((p) => `${p.path}${p.line ? `:${p.line}` : ''}`);
+  assert.deepEqual(paths('● Update(web/src/files.js)'), ['web/src/files.js']);
+  assert.deepEqual(paths('  ⎿  Wrote 12 lines to notes/todo.md'), ['notes/todo.md']);
+  assert.deepEqual(paths('error at src/app.py:42:7 and ./README.md:3'), ['src/app.py:42', './README.md:3']);
+  assert.deepEqual(paths('see /root/code/devdesk/Makefile'), ['/root/code/devdesk/Makefile']);
+  assert.deepEqual(paths('open https://code.lotusguild.org/a/b.js now'), []);
+  // Candidates only: they become links only if they're files of the session.
+  assert.deepEqual(paths('just some words, v1.2 and e.g. stuff'), ['v1.2']);
+});