Resolve AI client from host app and tighten session detectors (#1613)

* Make AI client IDE-only and tighten session detectors.

Client is cursor or vscode only; session detectors match grok/kilo/cowork/Copilot aliases without filling agent from TERM_PROGRAM.

* Resolve the client axis from the host editor, not the agent name.

Copilot and Claude both run inside JetBrains, Zed and VS Code, so deriving
client from the agent mislabelled those sessions (Copilot in IntelliJ reported
vscode). Read the window from editor-owned env instead, resolving VS Code forks
before upstream so a Cursor session can never be labelled vscode.

* Treat stock VS Code askpass as a vscode host.

After VS Code forks are ruled out, VSCODE_GIT_ASKPASS_MAIN/NODE prove the
window without requiring COPILOT_AGENT.

* Name the host app: IDE first, then Claude, then the terminal.

Client stays AI-only but is no longer IDE-only. After known editors,
standalone Claude reports itself, then TERM_PROGRAM maps to short names
(iterm, warp, tmux). Inherited TERM_PROGRAM=vscode is still omitted.

* Silence Go-Sec on the GIT_ASKPASS fixture path.

The path is test data proving generic git askpass cannot label the host.

* Prove the host app from install path and terminal fallbacks.

* Name host env vars and terminal spellings as constants.

* Fix Copilot alias fold, remote-SSH host detection, and Go-Sec G101 on askpass names.

* Rename wire-name helpers and restore Go-Sec nosec on the GIT_ASKPASS fixture.

* Keep host client independent of Cursor/Copilot agent names and unexport wire constants.

* Omit unknown TERM_PROGRAM from client and cite the Amazon Q env marker.

* Match JetBrains terminals on the real JetBrains-JediTerm env value.

Author: sverdlov93