(test): run the shipped app.js code in five replica tests (#171)

[devsuitup]

Closes #171

Five test files asserted against a copy of the logic written inside the test, so public/app.js was never loaded and a change to the real functions could not turn them red. They now run the shipped code.

What changed

• test/app-source.js (new): loadAppFunctions(context, { functions, declarations }) cuts the named top-level functions and one-line let/const declarations out of public/app.js and evaluates them in the jsdom window that setupSidebarDom() builds. app.js itself still cannot be evaluated whole.
• test/dom-setup.js: setupSidebarDom() also returns the VM context.
• Rewired to the real functions, with the outside edges stubbed and the real session-activity.js, sidebar.js, stop-session-ui.js, utils.js in the same window:
  • indexing-banner.test.js: updateIndexingBanner, dismissIndexingBanner
  • confirm-and-stop-session.test.js: confirmAndStopSession
  • open-session-terminal.test.js: openSession
  • search-perf.test.js: clearSearch, resetSearchFilter, runSearchQuery
  • running-indicators.test.js: updateRunningIndicators
• The source-text pins that stood in for the missing behaviour are gone; the behaviour is asserted instead. The dialogs.js pin stays.
• .ai/shared-guidelines.md: one line on how to test an app.js function.

The replicas had already drifted: openSession in app.js has guardResume, forgetSessionExit and syncPtySizeAfterOpen that the mirror lacked, and the real search clear defers the rebuild to an animation frame.

Tests only; no changelog entry (no-changelog label).

Proof

Each rewired file goes red when one line of production public/app.js is broken, and was green on the unmutated tree:

File	Mutation in public/app.js	Failing test
indexing-banner	indexingBannerDismissed = true on done:true	a done:true event resets the dismissed flag
confirm-and-stop-session	failure branch if (false)	a failed remote stop must not delete the pty id; a failed stop flashes the clicked button
open-session-terminal	drop { type: 'terminal' } for terminal sessions	a terminal session reaches open-terminal as a plain terminal; a terminal whose shell exited reopens under its own id
search-perf	clearSearch rAF callback resort: false	clearSearch: calls refreshSidebar with resort:true
running-indicators	remove if (item.dataset.subagent) return;	subagent items are untouched by the pty-set scan

Not verified

• session-restore.test.js and dom-sidebar-perf.test.js still carry partial inline mirrors of app.js logic; they were not part of this change.
• Windows only; CI on ubuntu not run.

[devsuitup]

Reviewing 228964b (adversarial review in progress).

[devsuitup]

Adversarial review at 228964b: no blocker, no major. All 44 top-level functions of public/app.js extract and compile with the scanner; one production mutation per file turns its test red (5/5); every dropped replica/source-regex test has a behavioural equivalent, plus three new behavioural tests. Being folded in: the regex-literal skipper has no end-of-file guard (an unterminated regex would hang the run), and a / inside a regex class or after if (x) truncates the extracted function — it fails loudly today only by luck; the slice will be compiled and its end checked.

[devsuitup]

Re-review at d2096a8: both minors closed — the regex skipper throws on an unterminated regex and understands [...] classes; every extracted slice must compile (vm.Script) and end at a line break, otherwise extraction throws naming the function; the undecidable if (x) /}/ case is refused loudly and pinned by a test (test/app-source.test.js, 8 cases). Ready to merge once CI is green on d2096a8.