feat: spawn omp panes through herdr's agent API

[atyrode]

When running inside herdr, the three launch paths (Enter / m / u) now create a proper herdr agent pane via agent.start over the mode-0600 JSON socket instead of exec-replacing the current pane — collapsing the herdr → code → omp chain into "popup picks, herdr places".

Contract

• Gate: HERDR_SOCKET_PATH present AND (HERDR_ENV=1 | HERDR_ACTIVE_PANE_ID/HERDR_ACTIVE_WORKSPACE_ID (custom-popup context, which herdr v0.7.4 does not give HERDR_ENV) | CODE_HERDR=1); CODE_HERDR=0 force-disables. Non-herdr contexts keep today's syscall.Exec unchanged.
• Fail-closed: when herdr mode is selected, an agent.start failure prints and exits non-zero — no exec fallback, so a popup can never silently become the omp session.
• Placement: workspace_id from HERDR_ACTIVE_WORKSPACE_ID → HERDR_WORKSPACE_ID (spawn lands where invoked); cwd always sent (HERDR_ACTIVE_PANE_CWD → os.Getwd) because herdr defaults omitted cwd to the server's cwd.
• Naming: omp @<cwd-base>; on agent_name_taken retries (2)… (9) with a fresh connection per request (herdr's API socket serves one request per connection).
• Security: OMP_AUTH_BROKER_* (including the bearer token value) travels only in the request's env map over the 0600 socket — never in any argv.

Verification

• go build ./... + go test ./... green (Go 1.22 via nix shell; repo has no devShell).
• Tests: request golden (argv order, env map, cwd, focus, newline framing), duplicate-name retry, non-duplicate fail-fast, gate matrix, argv parity with the exec builders, workspace_id presence/precedence.
• Live smoke in the operator's herdr session (VPS): stub-CODE_OMP run captured exact argv/cwd/broker-env delivery and pane placement/labeling; a real run then spawned a live omp pane (omp @dotfiles (2) — collision retry exercised live) that herdr's lifecycle integration detected (agent: omp, idle).

Follow-up (separate PRs): dotfiles popup keybind ([[keys.command]] type="popup" command="code" server-side with CODE_HERDR=1) after this tags a release and the pin bumps.