feat(share): support custom publishing helpers

[sam-saffron-jarvis]

Summary

• fix GitHub authentication checks to validate only the active account and keep CLI diagnostics out of user-facing errors
• introduce a provider-neutral transcript sharing layer with GitHub Gist as the zero-config default
• add the versioned term-llm-share command-helper protocol for private/custom publishers
• make Web, TUI, CLI, persistence, visibility, readiness, and error UX provider-aware
• retain legacy GitHub request/response and persisted-state compatibility
• add sessions share while leaving explicit session/agent Gist commands intact
• document the helper contract and configuration

Safety and compatibility

• helper execution is argv-only, bounded, timed out, process-group cleaned, and isolated in a private temporary bundle
• helper IDs/URLs/capabilities are validated; github is reserved for the built-in provider
• helper and gh stderr is bounded and operator-only, never returned to Web/TUI users
• response/conversation Web shares remain non-persisted; only whole-session shares can be updated
• legacy GitHub share fields are normalized and dual-written without a database migration
• raw reasoning is opt-in for generic CLI/TUI sharing and remains excluded from Web sharing

Review

• protocol/spec reviewed with Fable before implementation
• implementation reviewed with Opus; all blocking and practical medium findings were addressed, including ErrWaitDelay, relative helper paths, provider impersonation, readiness, capability caching, visibility correctness, diagnostics, raw-reasoning disclosure, and regression coverage

Verification

• focused sharing/config/Gist/session/TUI/cmd Go suites pass
• go vet ./...
• frontend format, lint, typecheck, and all 581 tests pass
• mise x node@24 -- make build
• git diff --check

Local focused suites, frontend checks, vet, and the canonical build pass. GitHub CI’s test and race jobs currently fail in the pre-existing flaky TestServeShellProcessGroupCleanup test (the shell prints an empty background PID); passkey-smoke independently times out locating its second-key Rename button. The sharing packages/tests pass, and cross-build/frontend checks are green.