Add saved project desktops and shared agent control

[Hydralerne]

What & why

Oblien now saves desktop sessions independently of workspace execution targets. Mindwire previously exposed one default screen, so separate projects could not reliably reopen their own desktop or show the screen used by an agent.

Add surface protocol 2 with a saved-desktop catalog, durable project associations and idempotent creation. The existing viewer, controller leases, approvals, captures and input receipts select the same desktop ID. Stop/delete retire only that desktop's controllers; slow management requests leave other desktops responsive. Resolution changes require an explicit stop on the current Oblien runtime, with a clear error instead of silently closing apps.

Project runs receive desktop instructions and the surface_desktops / surface_project_desktop tools alongside the existing five controls. Codex and Claude use per-turn MCP; other command-capable harnesses use the same service through a private temporary helper. Only workspace-scoped runtime credentials reach the daemon, and each run's tools enforce approval and project/session isolation. Add matching TypeScript/Go APIs, OpenAPI definitions, and a desktop guide.

Companion app work fixes cursor replacement, adds shared workspace/project desktop pickers and settings, and pins Oblien Swift SDK 2.8 parity.

Component

• daemon (Go)
• mindwire (TypeScript)
• docs
• repo / CI

Type of change

• Bug fix
• New feature
• New agent adapter
• Breaking change
• Docs only

Once a cloud runtime catalog is bound, a viewer must select a saved desktop ID. Legacy default-screen requests receive desktop_selection_required; personal Mac desktop setup and viewers keep their existing behavior.

Validation

• Go build, vet, race regression suite and focused API/SDK/concurrency tests passed. The optional external-account TestLiveClaude is excluded from the local regression run because this Mac's configured gateway returns malformed HTTP 200 responses; the installed Claude CLI passed the desktop MCP cycle against the local Messages fixture. Authenticated Codex also passed the native MCP cycle.
• TypeScript typecheck/build, unit tests and seven real embedded/Docker E2E tests passed; selected-desktop binding has an additional focused regression.
• govulncheck found no reachable vulnerabilities. The full web build and generated references passed.
• Live Azure tests passed with disposable desktops, followed by the native simulator and signed-in physical iPhone: saved-project creation/retry, SSH frames, automatic control, visibly verified text input, rename, foreground reconnect, stopped resize, restart, and deletion. The iOS desktop suite passed (55 tests, one optional live skip).
• Temporary desktops, isolated workload and credentials were removed; the installed Azure Mindwire service was not replaced by the test build.

Checklist

• I read CONTRIBUTING.md.
• Daemon: go build ./..., go vet ./..., and local regression tests pass (optional external gateway exception above).
• SDK: bun --filter='mindwire' run typecheck, run build, and run test pass.
• I added/updated tests where it made sense.
• I updated docs and API tables.
• New adapter: not applicable.