fix: reclaim idle remote runtimes and retire replaced agents

Remote tasks could leave idle Runtime processes behind, and replaced Agent
installations lacked a drain-and-exit lifecycle. Keep the current Agent
resident, let displaced Agents finish existing work and reconnect for its
results, then retire them without restarting obsolete installations.

Reclaim Runtime processes when their last active task finishes, preserve
pending questions and shared active tasks, and restore conversation history
when the next turn starts. Remove the Remote Projects technical preview label
from settings, errors, tests, and current documentation; the feature remains
disabled by default.

Validation recorded during implementation: 213 lifecycle tests and 28 focused
UI/IPC tests passed, as did SettingsPanel and lint. Linux x64 real-Host checks
used 8 provider requests. Broader tests and final typecheck encountered
unrelated concurrent changes; details and coverage limits are documented.

Release note: 远程任务结束后自动释放空闲运行进程，下一轮对话恢复历史；更新后的旧 Agent 等待已有任务完成再退出，当前 Agent 保持常驻。远程项目移除“技术预览”标识，仍默认关闭。

src/agent-daemon/cli.ts

@@ -375,6 +375,15 @@ async function runDaemon(
     protocol: verified.manifest.protocol,
     stateDirectory: paths.stateDirectory,
     socketPath: paths.socketPath,
+    isSuperseded: () => {
+      const registry = dependencies.installationRegistry ?? new InstallationRegistry({
+        storagePath: resolve(dirname(dirname(dirname(paths.executablePath))), 'registry.json')
+      })
+      const snapshot = registry.snapshot()
+      return snapshot.current !== undefined &&
+        snapshot.current.installationId !== installationId &&
+        snapshot.candidate?.installationId !== installationId
+    },
     peerIdentityProvider:
       dependencies.peerIdentityProvider ??
       await createLinuxPeerIdentityProvider(),
@@ -413,7 +422,10 @@ async function runDaemon(
       'registered',
       verified
     ).recordCurrentDaemonReady(daemon.status().daemonBootId)
-    await (dependencies.waitForShutdown?.() ?? waitForShutdownSignal())
+    await Promise.race([
+      dependencies.waitForShutdown?.() ?? waitForShutdownSignal(),
+      daemon.retired
+    ])
   } finally {
     await daemon.stop()
   }
@@ -436,7 +448,8 @@ async function runAttach(
   const { verified } = await loadManagedInstallation(
     installationId,
     paths,
-    dependencies
+    dependencies,
+    true
   )
   prepareManagedSocketDirectory(paths)
   const stateDirectory = paths.stateDirectory
@@ -454,6 +467,8 @@ async function runAttach(
       connectionId = welcome.connectionId
     },
     ensureEndpoint: async () => {
+      // A displaced installation may still serve detached work, but must not restart.
+      await loadManagedInstallation(installationId, paths, dependencies)
       await createDetachedLifecycle(
         installationId,
         paths,
@@ -686,7 +701,8 @@ async function runLifecycle(
       const { verified } = await loadManagedInstallation(
         installationId,
         paths,
-        dependencies
+        dependencies,
+        true
       )
       const lifecycle = createDetachedLifecycle(
         installationId,
@@ -702,7 +718,8 @@ async function runLifecycle(
       const { verified } = await loadManagedInstallation(
         installationId,
         paths,
-        dependencies
+        dependencies,
+        true
       )
       const lifecycle = createDetachedLifecycle(
         installationId,
@@ -820,7 +837,8 @@ async function verifyManagedInstallation(
 async function loadManagedInstallation(
   installationId: string,
   paths: ManagedInstallationPaths,
-  dependencies: AgentCliDependencies
+  dependencies: AgentCliDependencies,
+  allowRetired = false
 ): Promise<{
   verified: VerifiedInstalledAgentBundle
   registry: InstallationRegistry
@@ -832,6 +850,11 @@ async function loadManagedInstallation(
     new InstallationRegistry({
       storagePath: resolve(agentRoot, 'registry.json')
     })
+  const snapshot = registry.snapshot()
+  if (allowRetired && snapshot.current?.installationId !== installationId &&
+    snapshot.candidate?.installationId !== installationId) {
+    return verifyManagedInstallation(installationId, paths, dependencies)
+  }
   const registered = registry.assertRegisteredRole(
     installationId,
     ['current', 'candidate']