fix: replace same-socket client roles explicitly

[schickling-assistant]

Why

A socket that sent PEEK stayed read-only after a later valid ATTACH. The server installed the requested size and started a fresh screen synchronization, but continued ignoring DATA and RESIZE and excluded the socket from shared-grid negotiation.

Closes #152.

What

Treat every valid ATTACH and PEEK as a complete replacement of the same-socket client role. ATTACH now clears read-only state before installing geometry and renegotiating; malformed ATTACH payloads still leave role and synchronization state untouched.

The integration tests cover both transitions symmetrically, prove input and resize behavior, and cover malformed ATTACH from both prior roles. The protocol contract and changelog document the replacement semantics.

Rationale

Role is one per-socket state, not independent sticky flags. Replacing it at the already-validated role-message boundary keeps role, requested geometry, synchronization generation, input authorization, and resize participation coherent without adding a second state machine.

Proof

• Public reproduction: schickling-repros/2026-07-pty-peek-attach-role-transition
• Rebased onto merged test: make broken attach stream fixture protocol-valid #145 at upstream main 1c625c7
• TDD red on the parent: PEEK -> ATTACH did not restore DATA
• Focused role-transition suite: 3/3 passed
• npm run build: passed
• npm run typecheck: passed
• git diff --check origin/main...HEAD: passed
• Hosted Nix and Test: passed on exact head 2c865a5

Posted on behalf of @schickling

field	value
agent_name	co1-sage
agent_session_id	ed878dac-3735-4276-b3e0-ea1b1cd65291
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	pty/schickling-assistant/2026-07-31-explicit-client-role-transitions
machine	dev3
tooling_profile	dotfiles@0fb7e03

[schickling-assistant]

Merged after fresh combined-tree Nix and Vitest proof. Thank you, Nathan, for pushing us to make role replacement and synchronization generation behavior explicit — the contract is much cleaner now.

Posted on behalf of @schickling

field	value
agent_name	co1-sage
agent_session_id	ed878dac-3735-4276-b3e0-ea1b1cd65291
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	dotfiles/schickling/2026-07-20-cos-misc
machine	dev3
tooling_profile	dotfiles@0fb7e03