v0.3.4

Restore lean projectless local worker spawn (#299)

Closes #297.

## Summary

- restore `amux spawn` for the narrow projectless physical-host case,
with `amux worker spawn` as the exact alias
- rely on executor selection to route the command to the intended
physical host; spawn is local by construction, canonicalizes the
requested workdir, and requires no local process `--runner-id` alias or
attestation
- read and bound the complete prompt before taking the mutation lock;
dry-run remains lock-free, while real ownership/group/tmux preflight,
sole creation, input, and persistence stay under the existing machine
lock
- run `amp threads new --mode <exact-mode>` once in that cwd; retain
exact returned IDs, while nonzero/no-parseable-ID and zero/invalid-ID
results are sanitized as creation-indeterminate
- create one exact tmux continue pane, attempt one bounded literal
paste, and attempt one Enter only after paste succeeds; failed
loads/pastes scrub the exact randomized transport buffer
- preserve and report the exact thread and returned tmux identity—or
explicitly indeterminate requested identity—on every post-create
failure; never retry, search, read history/transcripts, archive, kill,
or reconcile
- after successful input attempts, report and persist the worker; for an
optional existing group, preflight the established additive Amp
capability before creation, then report/persist membership and
call/report the shared add-only label ensure

This follows the owner's clarification on #297: the historical local
`amux spawn` sequence is the baseline. It intentionally does not
introduce a new Amp server API or revive the removed worker-spawn
operation ledger/state machine. Creation and composer submission remain
separate controlled local steps.

## Verification

- focused spawn/tmux tests: plain unnamed runner/projectless path;
default and pass-through modes; multiline stdin/file; prompt-before-lock
ordering; mutable create under lock; group-aware lock-free dry-run;
sanitized human/JSON creation-indeterminate output; exact-ID
preservation; canonical cwd and ownership conflicts;
tmux/load/paste/Enter failures and exact buffer scrub; group
capability/persistence/label failures; truthful partial-success
outcomes; no retry/cleanup
- `go test ./...`
- `go vet ./...`
- `go build ./cmd/amux`
- Darwin cross-compile for `internal/tmux`
- `git diff origin/main...HEAD --check`
- focused final review: approved with no remaining blocker

## Residual behavior

The route is intentionally non-atomic after Amp returns a thread. A
reported post-create failure requires deliberate operator inspection;
rerunning spawn, repasting, pressing Enter, or cleaning up automatically
is forbidden. Readiness is transcript-free: amux requires the exact
returned Amp pane and continue command/environment to remain stable for
a bounded settle period before input attempts. Successful paste/Enter
commands are attempts, not transcript or inference proof.