wave 1 (platform stream): background-observability accuracy + owner-driven follow-ups

- observability: liveness-gated stale-job recovery, extraction run registry on globalThis with
  explicit 'embedding' phase, /api/jobs force-dynamic, client refresh nudges at every seam
- headless: providerSafePng canonicalizer (multi-IDAT Chrome PNGs → single-IDAT) fixing qwen 400s
- composer: Enter routes through pure enterAction — accepts a pending plan verdict (owner decision)
- markdown chrome: session-scoped mermaid overlay + md-blocks component set + pan-zoom math,
  corner-copy (clipboard grant in electron main), math/table/code block fixes, heading weight 900

543/543 tests; typecheck/lint/build clean

src/agent/subagents/aborts.ts

@@ -37,6 +37,18 @@ export function unregisterJobAbort(jobId: string): void {
 	registry().delete(jobId);
 }
 
+/** True while the job's loop is EXECUTING (a controller is registered) —
+ *  the liveness gate for the stale-job sweep: a "running" record with a
+ *  live registration belongs to a loop this process owns (hung or slow, it
+ *  is the one truth — never re-spawn beside it); without one the record is
+ *  an orphan of a process death and recovers immediately. The span is
+ *  loop-start to delivery-completion: the runner's unregistering finally
+ *  runs only after deliver() resolves, by which point finalizeJob has
+ *  flipped the record — so absence of registration is unambiguous. */
+export function isJobLive(jobId: string): boolean {
+	return registry().has(jobId);
+}
+
 /** Abort a running job's loop. Returns false when no controller is live —
  * the job's loop is not executing (crashed, or in the delivering-result
  * phase where the runner has already returned); the caller then owns the