Fix untrusted-workspace wedge: re-seed claude trust at every launch

Phase 4 (1517e4d) deleted the tmux launch path and with it the only
caller of claude_config.ensure_onboarded, so agent working dirs -
every fresh worktree is a brand-new path - were never pre-trusted in
~/.claude.json. Headless 'claude -p' runs then wedge or refuse on the
workspace-trust dialog with nobody at a TTY to accept it.

Spawn and resume now mark onboarding complete and trust the working
dir right before launch, next to the settings/claude_gen
materialization. Resume matters independently: a cross-worker resume
can land in a container whose ~/.claude.json has never seen the dir.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01731mKtVzsfeT4Vi3TvkR48

CHANGELOG.md

@@ -6,6 +6,16 @@ the image workflows publish (plus `latest` from every push to `main`).
 
 ## [Unreleased]
 
+### Fixed
+
+- **Untrusted-workspace wedge on headless runs.** Phase 4's tmux-path deletion also
+  removed the only call to `claude_config.ensure_onboarded`, so agent working dirs —
+  every fresh worktree — were never pre-trusted in `~/.claude.json` and headless
+  `claude -p` runs wedged or refused on the trust dialog with nobody at a TTY. Spawn
+  and resume now re-seed onboarding + per-directory trust before every launch (resume
+  included, so a cross-worker resume landing in a container that has never seen the
+  working dir is covered). 2 regression tests.
+
 ### Added — mobile app feature parity
 
 The iOS app (`app/`) catches up with everything the backend and web dashboard gained