feat!: headless is the only runner - delete the tmux run path (phase 4)

Agent runs are now always worker-owned 'claude -p' subprocesses; tmux
survives only for the interactive /login flow.

- deleted: worker.capture_agent_output/_pane_tail + the capture loop
  arm (the empty-/log bug's home), spawn's tmux launch/_claude_command,
  the tmux resume/kill branches (the silent-send-keys bug's home),
  tmux.session_name/list_sessions, the CLI attach subcommand, the
  'runner' setting
- spawn: task is now a hard requirement (headless has no idle REPL) -
  enforced in spawn (SpawnError) and the API (400); onboarding seeding
  dropped (-p skips the trust dialog)
- resume: single headless path; pre-headless agent rows (no session_id)
  degrade to the context-re-injection fresh run
- settings_gen: permissions allowlist is always emitted
- credsync: change-triggered uploads key on .claude/.credentials.json
  only (claude touches ~/.claude.json every run - keying on it would
  ping-pong uploads between workers); logins still publish explicitly
- cli list: liveness from agent_runs in the DB, not tmux
- tests: spawn/kill/resume re-pointed at the fake_launch seam
  (conftest); integration test now drives API -> worker -> real fake
  claude subprocess -> events endpoint; README documents the headless
  model + multi-worker deployment invariants

Suite 295 green; frontend unchanged since phase 3.

tests/test_worker_concurrency.py

@@ -16,7 +16,6 @@ from handler.db.engine import get_engine
 def headless_env(env, monkeypatch):
     from handler import config
 
-    monkeypatch.setenv("RUNNER", "headless")
     monkeypatch.setenv("MAX_CONCURRENT_RUNS", "2")
     config.get_settings.cache_clear()
     yield env
@@ -75,7 +74,3 @@ def test_slot_frees_when_run_finishes(headless_env, monkeypatch):
     with get_engine().begin() as conn:
         repo.finish_run(conn, run1["id"], "completed", exit_code=0)
     assert worker._full_slot_exclusions("w1") == ()
-
-
-def test_tmux_runner_never_excludes(env):
-    assert worker._full_slot_exclusions("w") == ()