fix: make agent reply cache lookup deterministic and fail closed

[BobDLA]

Summary

• make Claude, Gemini, and Codex reply-cache lookup deterministic via direct hits plus metadata-backed alias resolution
• fail closed for trusted-caller-only launches instead of probing unrelated agent caches
• split desktop smoke coverage into portable and unix-only scenarios, and add regressions for trusted-caller-only and gemini pid-only launches

Validation

Ran

• pnpm test -- src/app/hooks/useInitDocument.test.ts src/app/__tests__/useInitDocument.tauri.test.tsx
• cargo test --manifest-path src-tauri/Cargo.toml -- --nocapture
• pnpm build
• pnpm tauri:build

Not run

• pnpm test:e2e:desktop:unix
  • reason: package build was validated in this worktree, but the unix-only desktop smoke suite was not rerun after the final cleanup/build pass
• pnpm lint
  • reason: this change was covered by targeted frontend tests, Rust tests, and production/package builds