feat(cli-registry): drive the run-menu frontend from the CLI catalogue (PR B2)

PR #380 (PR B) held back the frontend half of the CLI registry refactor,
explicitly deferring window.__codemanCliCatalog and making session-ui.js /
mobile-overview.js catalogue-driven as "PR B2".

- Inject window.__codemanCliCatalog in renderIndexHtml(), following the
  existing __codemanCustomModelClis pattern (escapeScriptJson-guarded,
  resolved per-request). Reading CliEntry.shortBadge here is what makes it
  genuinely read, so it drops out of types.ts's DECLARED_FOR_LATER list.
- Consolidate session-ui.js's 8 near-duplicate run<Mode>() launch functions
  (opencode/codex/gemini/antigravity/pi/omp/grok/deepseek) into one shared
  _runCliMode() plus a local RUN_MODE_LAUNCH config table. The 8 method
  names stay as thin wrappers (index.html calls them by name; tests assert
  on the name). Also collapses a duplicated 8-way isAltMode/isExternalCli
  OR-chain (same expression, copy-pasted twice in openSessionOptions) into
  one EXTERNAL_CLI_MODES check.
- Add test/frontend-cli-no-id-branching.test.ts, a guard scoped to
  session-ui.js/mobile-overview.js only (not the rest of src/web/public/,
  which stays explicitly out of scope per CLAUDE.md), mirroring the
  backend's own no-id-branching guard.

mobile-overview.js and the wiring of accent/echo/wheelForward/
keyboardAccessory were investigated and deliberately left alone: the first
is already a single, tested, gated table (not duplicated logic); the second
set belongs to terminal-ui.js/keyboard-accessory.js/styles.css, files
outside this PR's mandate.

Verified on a tmux-capable devbox (this sandbox has no tmux): full CI gate
at 405 files / 7717 tests / 0 failures, typecheck clean, 94 targeted tests
covering exact per-CLI wire-body shapes unmodified and passing, and a live
anti-vacuity check on the new guard (injected a real branch, confirmed it
fails, reverted, confirmed green).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GuHtuPiHXdykq9T6rKQJ9n

test/render-index-html.test.ts

@@ -209,6 +209,38 @@ describe('WebServer.renderIndexHtml', () => {
     }
   });
 
+  it('exposes the general run-menu CLI catalogue with the menu-facing fields only', async () => {
+    // Unlike __codemanCustomModelClis above (narrowed to one picker's needs), this
+    // one carries every ENABLED CliEntry, agent and shell alike, with no capability
+    // filter — but still excludes launch/env/capabilities/overlays, the same rule
+    // scripts/generate-cli-catalog.mts follows for config/clis.stock.json.
+    const { server } = makeServer({});
+    const html = await render(server);
+    expect(html).toContain('window.__codemanCliCatalog=');
+    const catalog = JSON.parse(html.match(/window\.__codemanCliCatalog=(\[.*?\]);/)![1]) as Array<{
+      id: string;
+      label: string;
+      shortBadge: string;
+      order: number;
+      kind: string;
+    }>;
+    const ids = catalog.map((c) => c.id);
+    expect(ids).toContain('claude');
+    expect(ids).toContain('shell');
+    for (const cli of catalog) {
+      expect(typeof cli.id).toBe('string');
+      expect(typeof cli.label).toBe('string');
+      expect(typeof cli.shortBadge).toBe('string');
+      expect(typeof cli.order).toBe('number');
+      expect(['agent', 'shell']).toContain(cli.kind);
+      expect(cli).not.toHaveProperty('launch');
+      expect(cli).not.toHaveProperty('env');
+      expect(cli).not.toHaveProperty('capabilities');
+      expect(cli).not.toHaveProperty('overlays');
+      expect(cli).not.toHaveProperty('discovery');
+    }
+  });
+
   it('escapeScriptJson neutralizes a literal </script>, and still round-trips as a JS literal', () => {
     // CliEntry.label is a plain string a user's own clis.json can set (up to 60
     // chars), unlike __codemanCliAvailable's booleans-only payload, so this is
@@ -254,6 +286,7 @@ describe('WebServer.renderIndexHtml', () => {
     const html = await render(server, 'sess-123');
     expect(html).not.toContain('__codemanCliAvailable');
     expect(html).not.toContain('__codemanCustomModelClis');
+    expect(html).not.toContain('__codemanCliCatalog');
   });
 
   it('does not expose gesture at all when CODEMAN_GESTURE is unset', async () => {