chore(sync): merge upstream main and fix orchestration lifecycle races

[eyeveil]

Sync the fork with upstream main through 30cc788 while retaining account fallback, provider login, fork migration numbering, and desktop browser cloning. Fix the mobile clone error screen so users can still switch tabs or open a server tab in the server viewer.

Adapt three additional upstream fixes: pingdotgg#15820 preserves restart continuations for threads sharing a provider session; pingdotgg#16573 closes event subscriptions when a turn never starts; pingdotgg#15784 stops superseded startup attempts before native thread loading. Each includes regressions demonstrated failing before the fix.

Provider login start, input, resize, and cancellation now require providers:manage, matching upstream provider management permissions. Eight RPC authorization regressions cover denied and allowed grants.

Validation: 542 independently run focused tests passed, with one optional benchmark skipped. The follow-up authorization and permission-compatibility batch passed all 84 tests. Server, web, desktop, and mobile package typechecks passed. No browser/device verification or deployment was performed; UI evidence is not available.

Implementation: gpt-6.1-sol on mini_tailnet through the Codex harness. Coordination and independent verification: gpt-6-astra through the Codex harness.

[greptile-apps]

Confidence Score: 3/5

[High risk] Merges upstream and updates build configuration and CI workflows.

Fix the fork's provider-login permission checks before merging.

What we checked:

• Shared threads keep restart continuations: Recovery saves the session before stopping it. Later threads use that saved state when choosing whether to continue.

Summary

This PR brings in upstream changes while retaining the fork's features.

• Adds checks and cleanup around provider startup, turn subscriptions, and restart continuations.
• Keeps mobile browser tabs available when desktop cloning fails.
• Adds separate permissions for provider management, but leaves the fork's provider-login methods outside that check.

_{Reviews (1) · Last reviewed commit: "fix(server): stop superseded provider st..." · Reviewed by Greptile}