Add literal desktop insertion with reserved clipboard ownership

[iamnbutler]

Adds desktop_insert for literal Unicode and multiline text at the observed caret or selection. One GUI-owned plain-text paste preserves the exact process/window/editor binding, native operation lane, snapshot lease, and shared clipboard gate. Newlines never become synthesized Enter keys, and input has no automatic retry or typing fallback.

The GUI privately preserves bounded prior clipboard contents and restores them only when the paste key was never sent or the intended edit was observed. Uncertain delivery retains content-free ownership metadata in the existing gate so another automated paste cannot replace a pending payload. Exact receiver evidence or termination of its original process generation resolves ownership; GUI restart does not silently clear it. Delivery, consumption, clipboard cleanup, and ownership are reported separately.

Ace's rich-text composer also preserves plain-text line breaks as hard_break nodes, including blank and edge lines, instead of converting newline runs into paragraphs. Plain-text copying retains those breaks. Rich HTML and code-block paste retain their existing paths. This fixes the actual-composer mismatch without weakening native exact-text verification.

Refs #65, #8, #76, and #78. Public clipboard tools remain separate in #75.

Validation

Final head eff5e49d326264c8d9bf34f12e4378b8796f640f, integrated with feat/github-cache at 68b4a3f:

• Type checks, formatting/lint, independent source review, Ace diff review, the signed development build, and strict bundle/client signatures pass. React Doctor reports 100/100. Real ProseMirror schema/default-copy and Markdown round trips preserve Unicode and line breaks.
• The actual Ace composer passed one contextual Unicode/multiline replacement: exact surrounding text and UTF-16 caret, observed consumption, clipboard restoration and released ownership. Every chat's durable messages remained unchanged in live observation and independent replay; nothing was submitted.
• Two distinct signed clients exercised a real 10-second delayed paste. A second request refused without input or clipboard-generation change while the first was pending. The first receiver consumed only its own payload once; a fresh second insertion then resolved ownership through the native read-only proof and completed once. Both receivers and the private clipboard were cleaned up.
• Real pi/Anthropic runs passed completed insertion and Stop during an actually pending trusted paste. Stop retained the partial-input warning; the original paste arrived once afterward. Restarting the isolated channel worker preserved exact tool results/images and provider usage in both cases, with no repeated input. Final test cleanup restored the clipboard, and all fixture apps were closed.

Other applications may transform pasted text; an unmatched edit remains unknown with ownership reserved. Direct native-client death, GUI crash/restart during pending input, new hosted insertion coverage, and another physical machine remain broader work in #78/#8. The direct two-client ownership check is not presented as a two-channel test.

Built in Ace

Git/GitHub, builds, checks, React Doctor, and diff review used Ace terminals and its changes/patch APIs. Codex inspected/edited source and prepared disposable validation helpers because native Codex integration (#9) and Ace's file editor (#22) remain open. Codex computer use launched/focused the isolated apps, prepared the synthetic draft, and performed explicit cleanup; the behavior under test ran through Ace's signed native bridge and real channel tools. Validation used real macOS receivers and provider credentials, with no mocks or repository test fixtures.