feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/utils/snippetVariables.test.ts

@@ -55,7 +55,7 @@ describe('applyKeywordHighlights', () => {
     const osc = '\x1b]0;ssh root@165.154.155.48\x07'
     const out = applyKeywordHighlights(`${osc}Welcome to Ubuntu`, rules)
     expect(out).toContain(osc)
-    expect(out).not.toMatch(/\x1b\]0;.*\x1b\[38/)
+    expect(out).not.toMatch(/\x1b\]0;.*\x1b\[38/) // eslint-disable-line no-control-regex -- OSC must stay intact
     expect(out).toContain('Welcome to Ubuntu')
   })
 
@@ -102,7 +102,7 @@ describe('StreamingKeywordHighlight', () => {
     const done = stream.push('\x07Welcome', ipv4Rules)
     expect(done).toContain('\x1b]0;ssh root@1.2.3.4\x07')
     expect(done).toContain('Welcome')
-    expect(done).not.toMatch(/\x1b\]0;.*\x1b\[38/)
+    expect(done).not.toMatch(/\x1b\]0;.*\x1b\[38/) // eslint-disable-line no-control-regex -- OSC must stay intact
   })
 
   it('holds incomplete CSI across chunks', () => {