fix: steer active Codewith sends by default

[andrei-hasna]

Summary

• make plain dispatch send steer recognized active Codewith panes with Enter at the next safe agent boundary
• preserve explicit --queue delivery through the proven queue key and preserve guarded --if-idle refusal
• add regression coverage and align CLI/reliability documentation

Verification

• focused active Codewith tests: 4 pass, 0 fail
• engine tests: 63 pass, 0 fail
• non-tmux package suite: 475 pass, 31 skip, 0 fail
• typecheck and build: exit 0
• artifact scan: 190 members scanned, 0 findings
• staged and commit-patch secret scans: findingCount 0
• independent adversarial review: GO after two focused documentation remediations

The combined real-tmux suite reported seven 5-second hook timeouts under contention; every affected integration test passed when rerun individually. The existing hasna.contract.json schema validation failure is unchanged by this PR.

Task

Todos task 14927c9f-dc6d-48b2-b1ad-be7c6da1a91f (OPE63-00012).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #27 @ a431907 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at b6f918f.

What I ran:

• git log --oneline origin/main..HEAD — exit 0; one commit: a431907 fix: steer active Codewith sends by default.
• git diff origin/main...HEAD --stat — exit 0; 6 files changed, 63 insertions, 26 deletions.
• bun install — exit 0; setup only, 116 packages installed.
• bun run typecheck — exit 0; 0 TypeScript diagnostics.
• bun run test — exit 0; 496 pass, 3 skip, 0 fail, 499 tests across 39 files, 1606 expect calls. The three cross-machine tests were explicitly skipped because no reachable second host with bun+tmux was available.

What I read:

• The full diff for README.md, docs/cli.md, docs/reliability.md, src/lib/engine.test.ts, src/lib/engine.ts, and src/types.ts.
• Surrounding dispatch flow in src/lib/engine.ts, submit and confirmation behavior in src/lib/submit.ts and src/lib/confirm.ts, Codewith target detection in src/lib/exec-policy.ts, single-target CLI option mapping in src/cli/index.ts, bulk idle-only defaults in src/lib/bulk.ts, and the adjacent engine tests for active Codewith, explicit queueing, idle-only refusal, submit-key overrides, and auth-switch handling.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none. Coverage note only: the environment-dependent cross-machine integration lane was unavailable; local real-tmux integration and all unit/API/CLI/daemon lanes passed.