Fixes the SSE multi-consumer bug where multiple clients sharing the same
workspace received only a fraction of events (competing-consumer semantics
on a plain channel). Each caller to Events()/SubscribeEvents() now gets
its own dedicated channel via Broker.Subscribe(ctx).

💘 Generated with Crush

Assisted-by: AWS Claude Sonnet 4.6 via Crush <crush@charm.land>

The runner now compiles its own matchers, so a config round-trip can't
silently strip them. Hooks with an invalid matcher are dropped with a
warning instead of quietly matching everything.

A hook with a matcher like "^bash$" was firing on every tool call
after any config write, because the compiled regex was dropped when
the config reloaded. Recompile on reload so filtering keeps working.

Prior to this fix, notifications in the footer would not span the width
of the window, and text truncation would often happen prematurely.

Specifically, we describe the embedded-shell contract, Windows behavior,
permissive shebang fallback, guaranteed CRUSH/AGENT env markers, and
timeout hard-return semantics.

Share CRUSH=1/AGENT=crush/AI_AGENT=crush between the bash tool's Shell
and the hook runner so the two surfaces can't drift.

This in necessary so hook timeouts can now interrupt long-running
filters and large stdin reads for the builtin jq tool.

This is necessary for sharing the builtin shell with hooks.

We attempt to refresh tokens in two scenarios:

* Pro-actively, when we expiration date passed before a request
* Reactively, when we try a request but a 401 was returned

The error / event handling that shows a dialog asking the user to
re-authenticate is dependent on code that runs for the second scenario.
This means that the dialog might not show on the first scenario, if
refreshing the token fails.

If refreshing a token fails, continue with the previous token. Let it
fail and the 401 will trigger a re-authorization dialog.

I caught this because I was switching between local vs. prod Hyper a lot.

chore(styles): overhaul style definitions