feat(detect): configurable wrapper process detection

[kimchh]

Summary

When an agent runs inside a wrapper process (a sandbox, a custom launcher, a container entry point), herdr can't identify it because the foreground process name is the wrapper, not the agent itself.

This adds a [detection.wrappers] config map that teaches herdr how to see through wrapper processes to the agent underneath.

Each entry maps a wrapper process name to a detection strategy:

Strategy	Behavior
"inspect"	Scan the wrapper's argv for a positional arg or --flag matching a known agent name. Return None if nothing matches.
"inspect:<default>"	Same as inspect, but fall back to <default> if no agent is found in argv.
Any other string	Always resolve to that agent name (fixed mapping).

Example config

[detection.wrappers]
my-sandbox = "inspect:claude"    # look in argv, default to claude
sealed-box = "claude"            # always treat as claude
launcher = "inspect"             # look in argv, give up if not found

How it works

During process identification, if the normalized process name matches a configured wrapper, herdr applies the strategy against that process's argv before falling back to the standard detection path. This means existing detection behavior is unchanged when no wrappers are configured.

Changes

• src/config/model.rs — new DetectionConfig struct with wrappers: HashMap<String, String>
• src/config/io.rs — register the detection config section
• src/detect/mod.rs — configured_wrapper_agent() strategy resolver, plumbing through identify_agent_in_job and normalized_process_name
• src/pane.rs, src/app/agents.rs, src/platform/windows.rs — pass wrappers through call sites