Merge origin/main (v1.64.1.0) into garrytan/time-attack-fork-review

The code-smell wave refactored the tunnel start into the staged
startTunnel helper; the merge adopts that structure and threads this
branch's truthful consent strings through its consent parameter (the
receipt now names the isPairAgentEnabled gate at both call sites). The
eng-review PTY warmup takes both improvements: main's resolveClaudeBinary
fallback and this branch's resolveEvalModel kind. Resolver imports
union; carve budgets take the larger of both waves' measured values
(parity suite green on the merged tree); conflicted generated SKILL.md
files regenerated from resolved sources. VERSION stays 1.65.0.0 over
main's 1.64.1.0; CHANGELOG stacks 1.65.0.0 > 1.64.1.0 > 1.64.0.0.

scripts/test-free-shards.ts

@@ -78,13 +78,6 @@ const WINDOWS_FRAGILE_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
   // BROWSE_HEADLESS_SKIP=1 to skip the browser launch but still need a working
   // server, which they don't get on Windows.
   { pattern: /BROWSE_HEADLESS_SKIP|spawn\(\[['"]bun['"],\s*['"]run['"]/, reason: 'spawns the browse server subprocess (Bun-driven path is Windows-broken)' },
-  // Tests that read browse/src/sidebar-agent.ts — deleted in v1.14.0.0
-  // sidebar refactor (replaced by sidepanel-terminal.js). 10 security tests
-  // still reference it and fail on import. They've been broken on every
-  // platform since v1.14, but Bun on macOS/Linux reports the failure as a
-  // module-load error (exit 0) while Bun on Windows treats it as a hard
-  // fail (exit 1). Tracked as a follow-up: update or delete these tests.
-  { pattern: /sidebar-agent\.ts/, reason: 'reads deleted browse/src/sidebar-agent.ts (pre-existing breakage from v1.14.0.0 sidebar refactor)' },
 ];
 
 // Explicit known-Windows-incompatible test files that don't fit a regex