fix(agent): harden task rename ordering and focus

[AnthonyRonning]

Summary

Stacked on #771. This keeps its existing Goose-backed rename architecture and fixes the review findings before that change lands:

• reject unchanged/stale dialog submissions and make the native same-title path a true no-op, preserving first-turn automatic naming
• validate native titles as bounded, visible, single-line Unicode without breaking ZWNJ/ZWJ text
• order title-sensitive full-session events with an account/task-keyed lifecycle, avoiding cross-task provider stalls from the process-wide lifecycle lock
• prevent permission-mode and abandoned-send refreshes from republishing stale fallback titles
• restore pointer focus silently after rename, while keyboard close retains one ellipsis focus ring and never the nested full-row highlight

Validation

• repository pre-commit gate: Prettier, production frontend build, 657 frontend tests, and full Rust suite
• cargo test --all-targets --locked: 312 passed, 2 ignored
• canonical just rust-lint
• direct rustfmt --check for the cfg-gated Agent module
• canonical macOS desktop-pr.sh universal app/DMG build
• fresh independent frontend/UX, native/security, and integrated concurrency reviews: no remaining findings

Manual desktop note

The isolated workspace Tauri app launched successfully. Its clean overlay stopped at the sign-up/login gate; no account was created or existing account data used solely for the smoke test, so the authenticated rename interaction is covered by focused tests and independent review rather than an end-to-end account mutation.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	9fc3532
Status:	✅  Deploy successful!
Preview URL:	https://dd2b5501.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-pr771-fixes-mapl.maple-ca8.pages.dev

View logs