SeaShell 0.2.2

Lookout cards no longer sit on top of your work, and projects now remember which claude
session each pane was running.

Lookout cards moved to a side rail. A card used to overlay the pane that raised it, which
covered the very output you were trying to read. Cards now stack in a rail beside the panes.

Projects restore claude sessions. Saving a project captures the live session id of every
claude pane, and opening it types claude -r <id> into that pane's shell at the saved cwd.
The command runs where you can see it: if the session no longer resumes, the failed command
sits in a normal shell instead of a blank pane. Session ids are UUID-validated at save, at
load, and again when the command is built, so a hand-edited project file cannot turn restore
into arbitrary shell execution.

The file preview edits. Explicit save, and a conflict guard that refuses to clobber a file
that changed on disk under you.

Two hardenings on the control path. The look-only selector is now enforced in main at both
approve and type time rather than trusted from the renderer, and a control request whose tty
no longer matches its pane is refused instead of landing in whatever now occupies that pane.

The voidharbor all-in-one bundle is now recognized as a Lookout plugin install, so cards
work without installing c-assistant separately.

One build note: the 0.2.1 dmg was packaged from a working tree that still held a local
recording patch, so two unused environment-variable branches (SEASHELL_DEMO_HOME,
SEASHELL_USER_DATA) were compiled into it. Nothing reads them unless those variables are
set, but 0.2.2 is built from a clean tree and contains neither. 0.2.1's assets are unchanged.

macOS will complain on first open because the app is not signed with a paid Apple cert. The
one-line fix is in the README.