feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/build-script.test.mjs

@@ -10,10 +10,10 @@ import { inspectVersions, setVersion } from './set-version.mjs'
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 
 test('build.sh is valid Bash and documents supported native targets', () => {
-  const syntax = spawnSync('bash', ['-n', 'build.sh'], { cwd: root, encoding: 'utf8' })
+  const syntax = spawnSync('bash', ['-n', 'scripts/build.sh'], { cwd: root, encoding: 'utf8' })
   assert.equal(syntax.status, 0, syntax.stderr)
 
-  const help = spawnSync('bash', ['build.sh', '--help'], { cwd: root, encoding: 'utf8' })
+  const help = spawnSync('bash', ['scripts/build.sh', '--help'], { cwd: root, encoding: 'utf8' })
   assert.equal(help.status, 0, help.stderr)
   assert.match(help.stdout, /mac-arm64/)
   assert.match(help.stdout, /win-x64/)
@@ -21,7 +21,7 @@ test('build.sh is valid Bash and documents supported native targets', () => {
 })
 
 test('build.bat provides an equivalent native Windows x64 release path', () => {
-  const script = readFileSync(resolve(root, 'build.bat'), 'utf8')
+  const script = readFileSync(resolve(root, 'scripts/build.bat'), 'utf8')
   assert.match(script, /x86_64-pc-windows-msvc/)
   assert.match(script, /acceptance:full/)
   assert.match(script, /release-preflight\.mjs windows/)