feat(ru-fork): Windows spawn hardening, {cli} session-id copy, smarter installer, MCP probe

  Spawn policy
  - Route every process spawn through a shared policy (resolveSpawn): shell:false by
    default for executables (fixes project-add on Windows, upstream pingdotgg#2950), optional
    bash-routing via --windows-use-bash-for=<bin> / RU_FORK_WINDOWS_USE_BASH_FOR, and
    shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and
    move processRunner onto Effect's ChildProcessSpawner.
  - RepositoryIdentityResolver: classify git health instead of swallowing failures —
    git missing/unspawnable and timeouts surface as real problems, "not a repo" stays
    quiet, and None results aren't cached so a later `git init` is picked up.
  - terminal/Manager: detect live subprocess activity inside a Windows PTY via
    powershell.exe so a session isn't torn down while work is still running.
  - ServerEnvironment(Label): resolve the environment label through the spawn policy
    and normalize git output.

  Copy {cli} session id
  - Thread right-click "Copy" now copies the underlying {cli} session id, parsed from
    the assistant message id (assistant:assistant:<sessionId>:...), so a dialog can be
    resumed in the {cli} with `--resume <id>`. Scans the thread's messages
    newest->oldest, falls back to latestTurn, then to the internal thread id;
    brand-neutral via CLI_DISPLAY_NAME.

  Installer / CLI resolution
  - install: smarter shell-profile handling. When no shell rc file exists, create the
    right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for
    zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when
    no rc is writable (the bin still runs via its full path), distinguishing "no rc at
    all" (create one) from "rc is read-only" (warn).
  - resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash
    .install-dir record (/c/...) to native form (C:\...) and compare case-insensitively,
    so the recorded path matches the home-bin copy and Windows installs don't trip a
    false SOURCES_DISAGREE.

  MCP probe (new, throwaway)
  - mcp-probe/: self-contained harness proving the planned MCP-management engine
    contract (settings overlay via the {cli}'s system-settings-path env +
    --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building
    the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor,
    and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

  Tests
  - Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel
    coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

Author: ru-code-dev

apps/server/src/environment/Layers/ServerEnvironment.ts

@@ -5,6 +5,7 @@ import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
 import * as Random from "effect/Random";
 
+import * as ProcessRunner from "../../processRunner.ts";
 import { ServerConfig } from "../../config.ts";
 import { ServerEnvironment, type ServerEnvironmentShape } from "../Services/ServerEnvironment.ts";
 import packageJson from "../../../package.json" with { type: "json" };
@@ -93,4 +94,7 @@ export const makeServerEnvironment = Effect.fn("makeServerEnvironment")(function
   } satisfies ServerEnvironmentShape;
 });
 
-export const ServerEnvironmentLive = Layer.effect(ServerEnvironment, makeServerEnvironment());
+export const ServerEnvironmentLive = Layer.effect(
+  ServerEnvironment,
+  makeServerEnvironment(),
+).pipe(Layer.provide(ProcessRunner.layer));

apps/server/src/environment/Layers/ServerEnvironmentLabel.ts

@@ -4,7 +4,7 @@ import * as OS from "node:os";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 
-import { runProcess } from "../../processRunner.ts";
+import * as ProcessRunner from "../../processRunner.ts";
 
 interface ResolveServerEnvironmentLabelInput {
   readonly cwdBaseName: string;
@@ -53,19 +53,16 @@ const runFriendlyLabelCommand = Effect.fn("runFriendlyLabelCommand")(function* (
   command: string,
   args: readonly string[],
 ) {
-  const result = yield* Effect.tryPromise({
-    try: () =>
-      runProcess(command, args, {
-        allowNonZeroExit: true,
-      }),
-    catch: () => null,
-  }).pipe(Effect.orElseSucceed(() => null));
-
-  if (!result || result.code !== 0) {
+  const processRunner = yield* ProcessRunner.ProcessRunner;
+  const result = yield* processRunner
+    .run({ command, args: [...args], timeoutBehavior: "timedOutResult" })
+    .pipe(Effect.option);
+
+  if (result._tag === "None" || result.value.code !== 0) {
     return null;
   }
 
-  return normalizeLabel(result.stdout);
+  return normalizeLabel(result.value.stdout);
 });
 
 const resolveFriendlyHostLabel = Effect.fn("resolveFriendlyHostLabel")(function* (