v1.4.2

Fix reconnect/leak/multi-viewer bugs + online critical-upgrade forcing

Three bug fixes found in a code review:

- Terminal blank on reconnect to an IDLE session (agent.go runSender): a
  caught-up viewer reconnecting sent resume{from_seq=N} whose cursor was past
  everything still buffered, so neither a snapshot nor a replay went out and the
  screen stayed blank until a keystroke. Now every resume paints one snapshot;
  up-to-date viewers drop it via seq dedup.
- Keep-awake (display-sleep inhibitor) leak (windows.go streamWindow): a stream
  that self-exits (window closed, viewer silent) bypassed stopWindowStream and
  never released winAwake, pinning the host awake forever — worsened by the
  v1.4.1 close-detection. The defer now releases it when the last stream ends,
  and clears the stale winMenu entry.
- WebRTC starved WS-only viewers (windows.go): once one viewer confirmed a
  DataChannel, frames went ONLY to confirmed DCs, freezing every WS-only viewer.
  Frames now also go over WS whenever a viewer isn't on a confirmed channel
  (wsSinkNeeded); an all-P2P set still skips WS to save relay cost.

Also adds an online, maintainer-controlled critical-upgrade switch: the Worker
serves /version → {critical_min} (from a CRITICAL_MIN wrangler var, empty by
default). On its normal ≤24h check, a client below critical_min force-installs
the upgrade automatically — no `--force`, no user action — so a security fix can
be pushed out fast. Best-effort; the binary still comes from the signed release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>