fix(panel): find the right iTerm2 tab for tmux panes on any title setup

[StuBehan]

Clicking a tmux-hosted event or session was raising iTerm2 without switching to the tab. Focus matched the iTerm2 session name against tmux's pane_title, and name is the tab bar title, so with the job shown in the title (✳ stack-nudge (claude)) nothing matched. A profile title setting can also turn autoName into just the profile name, so no title is a safe key.

Now it goes most exact first:

• -CC tabs by iTerm2's tmuxWindowPane, only when a control-mode client is attached to that server (pane numbers repeat across servers)
• tmux drawn in a normal tab, by the attached client's own ITERM_SESSION_ID, then its tty
• a title match (with or without the (job) suffix) only under -CC and only when it's unique, for iTerm2 builds before 3.3

The host terminal now comes from the client's env (__CFBundleIdentifier, then TERM_PROGRAM) rather than the agent's LC_TERMINAL, which is whatever was attached when the pane's shell started.

Also adds an Automation → iTerm2 row to Permissions, since that grant is separate from System Events and a denial made focus fail with nothing saying why.

Testing: 1254 tests pass under make test-without-xcode, and a harness running the real matcher over my live iTerm2 + tmux resolved 30/30 panes, pi included. Not tried live yet: tmux in a normal (non -CC) tab.