fix: harden sidebar, approval, and updater lifecycle

[GCWing]

Summary

• refine session-row status/action layout and add right-click workspace menus with viewport-safe anchoring
• clarify permission and update confirmation surfaces with canonical UI components, complete resource copy/readability, and explicit exact-command grants
• keep updater/restart handoff processes alive while final cleanup closes only managed child trees, with Windows lifecycle contracts added to the OS matrix

Verification

• cargo test -p openbitfun-services-core --no-default-features --features process-runtime --test process_runtime_contracts
• cargo test -p openbitfun-services-core --no-default-features --features process-runtime --lib process_tree::tests::
• pnpm --dir src/web-ui run test:run src/app/components/NavPanel/sections/sessions/SessionsSectionLayout.test.ts src/app/components/NavPanel/sections/workspaces/WorkspaceListSectionLayout.test.ts src/app/components/NavPanel/unifiedSessionCreation.test.ts src/shared/utils/useSideAnchoredPopoverPosition.test.tsx src/flow_chat/components/ChatInputApprovalBand.test.tsx src/flow_chat/components/CopyableTextPreview.test.tsx src/infrastructure/update/UpdateInstallProgressModal.test.tsx
• pnpm run check:web
• pnpm run i18n:audit
• pnpm run motion:audit
• pnpm run check:github-config

Validation boundaries

• No browser or mock visual validation was used; rendered visual acceptance is not claimed.
• Remote workspace, remote control, Peer Device Mode, and Detached Dispatch were not exercised. Evidence is limited to local Windows process tests and shared Web UI code/contract checks.