fix(cli-registry): address PR B2 review — fix two test guards, drop unused catalogue

Two required fixes from Ark0N's review of #458:

1. test/frontend-cli-no-id-branching.test.ts's ALLOWED_BRANCHES keyed on
   <file>::<line>::<expression>. A single inserted line anywhere above an
   entry shifted every subsequent line number, so all 21 entries went stale
   simultaneously and the same 21 branches were reported as "new" — on a
   file six other open PRs also touch. Dropped the line number from the key
   (<file>::<expression>, matching the backend guard's own design), which
   collapses 21 line-keyed entries to 11 or-collapse where the same
   expression recurs at multiple call sites in the same file.

2. test/run-mode-ui.test.ts's terminal-ownership guard scanned method
   bodies via `^ {2}async (run[A-Za-z]*)\(\) \{$`, which matched the 8
   one-line run<Mode>() wrappers PR B2 introduced but not _runCliMode(mode),
   where the real logic (and the actual risk the guard exists to catch) now
   lives. Fixed the regex to `^ {2}async (_?run[A-Za-z]*)\(\w*\) \{$` and
   added _runCliMode to the sanity list. Same-class fix in
   test/opencode-resize.test.ts, which had the identical blind spot via
   runOpenCode.toString().

Both reproduced live before fixing (inserted the same comment line; added
this.terminal.clear() to _runCliMode) to confirm the bug, then confirmed
the fix catches it and the suite stays green otherwise.

Also resolves Open Question 2 by dropping window.__codemanCliCatalog
entirely: nothing consumed it, and a registry DECLARED_FOR_LATER field
costs nothing until read while an unconsumed script tag on every page
render is a different trade. Reverts Phase 1 cleanly — server.ts's
injection, shortBadge back in types.ts's DECLARED_FOR_LATER list and the
pinned guard test, and the three associated render-index-html.test.ts /
server-index-title.test.ts assertions.

Full gate: 405 files / 7717 tests / 0 failures (net unchanged), typecheck/
lint/format clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GuHtuPiHXdykq9T6rKQJ9n

src/web/public/session-ui.js

@@ -20,15 +20,14 @@
  * near-identical bodies guaranteed to drift, exactly what the CLI registry's
  * own no-id-branching rule exists to prevent server-side.
  *
- * Deliberately a LOCAL table rather than reading `window.__codemanCliCatalog`
- * (server.ts, PR B2): that catalogue carries only menu-facing metadata
- * (id/label/shortBadge/order/kind), and several unit tests exercise these
- * run*() methods inside a bare `vm.createContext()` sandbox with no `window`
- * global at all (see test/run-mode-ui.test.ts) — referencing `window` there
- * unguarded would throw, not degrade. `buildConfig` returns the CLI's
- * top-level legacy config field for a LOCAL launch, or `null` for a CLI that
- * sends none (pi: no bypass flag exists, so there is nothing to send — see
- * runPi's own history below for why that must stay true).
+ * Deliberately a LOCAL table rather than a server-injected catalogue: several
+ * unit tests exercise these run*() methods inside a bare `vm.createContext()`
+ * sandbox with no `window` global at all (see test/run-mode-ui.test.ts) —
+ * referencing `window` there unguarded would throw, not degrade. `buildConfig`
+ * returns the CLI's top-level legacy config field for a LOCAL launch, or
+ * `null` for a CLI that sends none (pi: no bypass flag exists, so there is
+ * nothing to send — see runPi's own history below for why that must stay
+ * true).
  */
 const RUN_MODE_LAUNCH = {
   opencode: {
@@ -112,9 +111,9 @@ const RUN_MODE_LAUNCH = {
 
 /**
  * External (non-Claude, non-Shell) CLI run modes — the keys of RUN_MODE_LAUNCH
- * above, kept as its own Set so `_isAltCliMode()` doesn't recompute an array
- * every call. Single source for what used to be two hand-copied 8-way
- * `session.mode === '<id>' || ...` chains inside one function
+ * above, kept as its own Set (`EXTERNAL_CLI_MODES.has(mode)`) rather than an
+ * array recomputed per call. Single source for what used to be two hand-copied
+ * 8-way `session.mode === '<id>' || ...` chains inside one function
  * (`openSessionOptions`), guaranteed to drift from each other the moment a
  * ninth CLI landed in one and not the other.
  */