* Handle prerelease tags when publishing GitHub releases

- Derive `is_prerelease` and `make_latest` from the version format in preflight
- Mark suffixed versions (for example `1.2.3-alpha.1`) as prereleases
- Keep only plain `X.Y.Z` releases marked as latest
- Document prerelease/latest behavior in `docs/release.md`

* Force desktop auto-updates to stable latest channel

- set Electron updater channel to `latest`
- disable prerelease and downgrade updates regardless of app version

…404)

Add a pre-flight version check that runs `codex --version` and blocks
session startup with a clear upgrade message when the installed CLI is
below v0.37.0. The check runs both synchronously at session start
(codexAppServerManager) and during provider health probes
(ProviderHealth), so users get fast feedback in the UI.

Introduces `codexCliVersion.ts` with semver parsing, comparison, and
formatting helpers shared by both call sites.

* refactor(contracts): export ProviderStartOptions schema

* feat(contracts): add providerOptions to ThreadTurnStartCommand

* feat(web): send codex binary/home path settings to server

* feat(server): thread providerOptions through to session startup

* fix(contracts): define ProviderStartOptions inline to avoid circular dep

The import from provider.ts caused a ReferenceError at runtime because
of module initialization order in the bundled output.

* fix(server): preserve providerOptions across runtime mode changes and session recovery

Runtime mode toggles and server restarts silently dropped the custom
codex binary/home path, falling back to the default binary. Cache
providerOptions per thread in ProviderCommandReactor and persist it in
the session binding's runtimePayload so recovery can restore it.

Closes #486

- Drop the redundant static bullet before the working status text in `MessagesTimeline`
- Keep the animated dots indicator as the sole working-state visual cue

- Update GitActionsControl quick/menu action text for existing pull requests
- Align unavailable-state copy and tests with the new label

When T3 Code web mode is accessed via HTTPS (e.g. through a reverse proxy
or Tailscale Serve), the WebSocket connection must use wss:// instead of
ws://. Browsers block mixed content — an insecure ws:// connection
initiated from an HTTPS page.

Fix: derive the WebSocket protocol from window.location.protocol.

Co-authored-by: PatrickBauer <patrick@patrickbauer.dev>