feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/run.bat

@@ -0,0 +1,31 @@
+@echo off
+setlocal EnableExtensions
+chcp 65001 >nul
+
+rem OpsXShell local GUI launcher (Windows).
+rem App log path matches src-tauri infrastructure/file_log.rs (dirs::data_local_dir).
+
+cd /d "%~dp0.."
+
+set "PID_FILE=%TEMP%\opsxshell.pid"
+set "APP_LOG=%LOCALAPPDATA%\opsxshell\logs\opsxshell.log"
+
+echo.
+echo [opsxshell] starting...
+
+if not exist "node_modules\" (
+  echo [opsxshell] npm install...
+  call npm install
+  if errorlevel 1 exit /b 1
+)
+
+echo [opsxshell] npm run dev
+echo [opsxshell] app log: %APP_LOG%  ^(max 10MB x 3 files^)
+start /b "" cmd /c "npm run dev"
+
+echo %DATE% %TIME% > "%PID_FILE%"
+
+echo [opsxshell] started. Tail app log with:
+echo   powershell -Command "Get-Content -Path '%APP_LOG%' -Wait -Tail 50"
+echo.
+exit /b 0