fix(workspace): restored panes read their persisted ghost log - #1227

Nothing had read <userData>/ghost-logs/<id>.ghost.jsonl on restore since
0cb71e9: the only reader was a spawn-time bootstrap keyed by the fresh
spawn id, which never matches the persisted log after a reload. Unsent
and in-flight prompts vanished from restored panes, and 1,935 of 1,952
logs on disk were orphans.

The history load now reads the log under the durable session id in
parallel with the transcript, reconciles it against committed turns, and
appends back only entries whose state changed. The dead spawn bootstrap
is removed.

Fixes #1225

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Review of #1227 (blocker): reading the log painted committed turns a
second time at the bottom of restored feeds. Render rule 4 shows an
orphan newer than the committed tail, and a logged ghost's updatedAt is
its orphan time (last delta + 30 s) or, if never orphaned, the restore
itself: both after its own commit. Every Codex text ghost (its response
id never matches the rollout turn id) and Claude tool calls committed
above the loaded window came back.

Restored ghosts are now re-dated to their createdAt and marked orphaned.
A crash-mid-turn ghost began after the last commit and still paints;
any ghost of a turn that committed began before it and is hidden.

Tests use two more real sessions (fixture stale-ghosts-after-restore)
and assert on the merged feed: no stale ghost paints for Claude or
Codex, and the Codex final answer paints when the tail is cut before it.
Dropping the re-date fails all three.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Steering note q6 on #1227: re-dating restored ghosts to createdAt hides
a ghost that began before the last commit and kept streaming after it.
Scanning 7,128 Codex ghosts against their rollouts found 7 such
straddles (the rollout write lags the proxy; one by 34 ms), each of
which a crash would have left as the only copy.

The restore clock is now the ghost's last content update: the newest
updatedAt among its un-orphaned records (Claude logs every update), or
orphanedAt - TTL for a Codex log that holds only the orphan record (an
upper bound, so in doubt it paints). What that bound lets through, a
Codex response that did commit, is removed by identity: the chunk's
token_usage_record names each committed response_id.

GHOST_ORPHAN_TTL_MS moves to ghosts.ts, the one value the sweep and its
inverse share. The recorded straddle joins the fixture; createdAt as the
clock, no identity check, and no re-date each fail a different test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>