[abruption]

Adds opt-in send --wake and a separately authorized MCP wake capability. Plain send remains queue-only. Wake validates the selected home, original cwd and writer state, submits once, then uses native app-server thread/resume without an additional user prompt. Queue IDs survive activation errors, timeout and interruption; completion never implies confirmed consumption.

Closes #46 when both integration stages reach main. Stacked on #77, which depends on #76. Merge order: #76 → #77 → this PR; retarget this PR to main after #77 merges. CI now runs for feature-targeted PRs as well as main.

Implementation:

• Evidence-based initial support: Codex CLI 0.154.0, macOS/Linux. Other wake versions/platforms fail closed; ordinary sends remain available.
• Per-home/thread guard plus native writer exclusion, active-writer queue-only path, rejection of archived/missing/uninitialized/unknown targets.
• Bounded 1–60 second activation (default 30), owned-process cleanup on deadline/SIGTERM/SIGHUP, no trust/approval bypass or automatic resend.
• Native approval requests fail explicitly. Noninteractive MCP client approval remains separately configured by the operator.

Validation:

• 277 tests pass locally with MCP extra; existing CLI/SSH/home regression suite retained. New native subprocess fixtures verify protocol, deadline, cleanup, approval failure, guards, queue-ID preservation, interruption, remote partial failures and MCP capability separation.
• Native CLI 0.154.0: a second writer for the same UUID is rejected; promptless exec resume fails, while app-server resume consumes a queued test message without turn/start.
• Real Codex MCP client: local Codex list/send/wake and SSH macbook Orca custom-home list/send/wake succeed. Local/mac-mini and KR SSH Claude-protocol fixture inboxes each receive one message (not production Claude sessions).
• Remote default-home revoked auth produces a queued submission plus failed wake with the queue ID and error retained. Authentication was not changed. Initial client approval refusal was also verified; successful tests used explicit per-tool authorization only in isolated client settings.
• Live wake tested on macOS; Linux lifecycle/lock coverage is CI fixtures, not a credentialed model run. No release, production plugin installation or credentials copied.

Limit: waits for one native turn, not the whole queue; a timeout can interrupt partially completed work. See docs/wake.md for result semantics and support boundaries.