fix(shell-integration): resync all three packaged copies with src - #169

Both PRs ended by asking which direction I wanted for the checked-in
duplicates. This is the answer: keep them, and check them.

resources/shell-integration/ is a copy of src/shell-integration/, and
resources/cli/*.js a copy of the tsc output in dist/cli/. Nothing kept
either in step and both had rotted — the packaged PowerShell integration
predated the pipe's auth gate, so it sent V1 lines with no token and every
report was rejected into a void with no way to notice, and the CLI copy
was ~1700 diff lines behind its own source.

That is exactly #137, where a second copy of the app icon went stale for
three releases: a duplicate with no enforcement is not a duplicate, it is
a time bomb. #169 resynced today's drift; this stops tomorrow's.

Deletion was the other option offered and is not taken here. Nothing wmux
ships reads either directory (extraResources maps src/shell-integration
and dist/cli), but external consumers read them out of a repo checkout —
which is how the drift was found — and removing a path they depend on is
not something to do silently in a patch release.

Split by what each half costs:

- npm test covers shell-integration, which needs no build, so the check
  gates a release through CI's existing test step.
- npm run verify:resources covers the CLI artifacts too, and CI runs it
  after build:main, which is what makes dist/cli exist. It skips loudly
  rather than passing quietly when dist/ is absent — a check that
  silently does nothing reads as coverage it is not providing.

resources/cli/*.js is regenerated here to make the invariant true.

Claude Code increasingly runs in a Linux devcontainer while wmux runs on
Windows. Nothing in that container can open \\.\pipe\wmux, so the CLI, the
hooks and the shell integration all failed silently: no cwd, no git branch,
and a sidebar stuck on "Running" forever.

The bridge from issue #78 is most of the answer already — it just could not
reach the pipe from where it needed to run. Three pieces close the gap:

* connectTransport() learns npiperelay.exe, so `wmux bridge` can run INSIDE
  WSL2 and still reach the Windows pipe over interop. That placement is the
  security property: 0.0.0.0 there is the WSL2 namespace, reachable from
  containers on the host and not from the LAN, with no firewall rule. AF_VSOCK,
  a Windows-side listener and cross-boundary Unix sockets were tried first and
  are documented as rejected in the code.
* The bridge keeps relays warm and tears down half-close-aware. Spawning
  npiperelay measures ~7s on an AV-scanned corporate host, and destroying both
  sides on either 'close' killed the frame of any client that writes and hangs
  up — which is every Claude Code hook. Deadlines gain a floor on the slow
  transports for the same reason; the 5s default sat below the round-trip, so
  calls that had already succeeded were reported as timeouts.
* `wmux raw-v1` gives the bash integration a way to send its V1 lines through
  the CLI's transport instead of a temp file it cannot write to, and
  wmux-hook.js gets the same TCP branch.

report_startup_command is new and rides the same path: a shell declares how to
bring its own surface back, stored per surface, so a restored pane re-enters
its container instead of coming up as a bare WSL prompt.

docs/DEVCONTAINER.md is the standalone setup — one binary, one command, two
environment variables, no vendor tooling.

Two things ride along that were separate commits in #166, because on current
master they have nothing to stand on their own for. The npiperelay lookup
splits PATH on path.delimiter and falls back to process.env.Path — the
Windows spelling — which only matters for the finder this commit introduces;
#168 landed the rest of that change and deliberately left this half behind.
And resources/shell-integration/wmux-bash-integration.sh is updated in step
with its source, which #169 plus the check in 42e3cca now require: the
packaged copy was resynced from a pre-bridge src/, so it has the `wmux` shim
but not the WMUX_REMOTE branch, and leaving it that way fails npm test.

Co-Authored-By: Claude <noreply@anthropic.com>