chore: bump version and changelog (v1.45.0.0)

Design boards now live 24h, not 10 minutes. One daemon hosts every
board, one tab survives the whole day. See CHANGELOG.md for the full
release summary + metrics + itemized changes.

TODOS.md gains a "design daemon: follow-ups" section capturing the
P3 test gaps + maintainability nits the /ship review army flagged
but that aren't blocking for this release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

TODOS.md

@@ -1,5 +1,73 @@
 # TODOS
 
+## design daemon: follow-ups (filed v1.45.0.0 via /ship review army)
+
+### P3: Tighten daemon test coverage
+
+**What:** Three test gaps the testing specialist flagged on the v1.45.0.0 ship:
+
+1. `design/test/daemon.test.ts:441` (`bare GET /api/progress does NOT reset
+   meaningful activity`) is a smoke test pretending to be a behavioral test.
+   Its own body comment admits it can't read `lastMeaningfulActivity` in-process
+   and only asserts the endpoint stays functional. Move to
+   `daemon-discovery.test.ts` with `DESIGN_DAEMON_IDLE_MS=2000` +
+   `DESIGN_DAEMON_CHECK_MS=200`, poll `/api/progress` in a loop, wait
+   `IDLE_MS+CHECK_MS`, assert the daemon process actually exited.
+
+2. `design/test/daemon-discovery.test.ts:14` docstring claims a
+   "concurrent-CLIs race (two real subprocesses, one wins the lock)" test
+   exists. It doesn't. Add one: fire two `ensureDaemon()` calls in parallel
+   against the same stateFile via `Promise.all` (or two real subprocesses);
+   assert both resolve to the same port, exactly one `spawned=true`, exactly
+   one daemon process alive, no orphaned lock file. This is the primary
+   correctness gate for the new daemon's spawn-vs-attach race.
+
+3. `design/test/daemon.test.ts:462` `idleCheckTick` only has a "callable
+   without throwing" smoke. The 24h-extension-with-active-boards path
+   (`daemon.ts:240-252`) and the `MAX_EXTENSIONS` hard ceiling
+   (`daemon.ts:244-247`, force-shutdown after 4 extensions) are untested.
+   Both are load-bearing for the 24h timeout this PR ships.
+
+Plus: missing malformed-JSON tests for `POST /api/boards` and
+`POST /boards/<id>/api/reload` (only feedback has one); missing stale-lock
+reclaim test (`daemon-state.ts:208-213` PID-dead branch is only exercised
+indirectly).
+
+**Pros:** Closes real coverage gaps that ship-time review surfaced. Each test
+is small (one or two `it()` blocks).
+
+**Cons:** None — these are additive tests, no behavior change.
+
+### P3: Minor maintainability nits from /ship review
+
+- `design/src/cli.ts` and `design/src/serve.ts` both have a small `openBrowser`
+  helper with identical darwin/linux/else branches. Extract a shared
+  `design/src/open-browser.ts`.
+- `design/src/daemon-client.ts:320` (`AbortSignal.timeout(2000)`) and `:357`
+  (`delay(50)`) use bare numeric literals while sibling timeouts are named
+  constants. Promote to `SHUTDOWN_POST_TIMEOUT_MS` and `ALIVE_POLL_INTERVAL_MS`.
+- `design/src/daemon-state.ts:21` `serverPath` field is written
+  (`daemon.ts:541`) but never read by production code. Either remove or
+  document the forensic intent.
+
+### P3: Daemon scope deferred from v1.45.0.0 plan
+
+Originally listed in the plan's "TODOs surfaced for later" section:
+
+- Per-daemon scoped auth tokens (only relevant once a tunnel/share use case appears).
+- Optional persistent board history on disk in
+  `~/.gstack/projects/$SLUG/designs/history/` so submitted boards survive
+  daemon restarts.
+- Windows spawn branch lifted from browse (V1 daemon is macOS + Linux;
+  Windows users fall back to legacy `--no-daemon` per-process server).
+- `$D board list` / `$D board stop <id>` per-board ops CLI (V1 has only
+  `$D daemon status` / `stop`).
+- Cross-worktree daemon attach (conductor sibling worktrees of the same
+  repo currently each spawn their own daemon — matches browse; revisit
+  if it causes friction).
+
+---
+
 ## browse server: terminal-agent teardown follow-ups (filed v1.41 via /plan-eng-review)
 
 ### ✅ DONE (v1.44.0.0): Identity-based terminal-agent kill (replace pkill regex with PID)