🤖 fix: prevent message edits from hanging during active streams - #4153

## Summary

Prevent the local-agent interference warning from flashing for
coordinated sub-agents, while retaining it for unrelated local task
families sharing the project directory. Follow-up UX fix after #4153.

## Implementation

- Derive frontend-only family roots during the existing bulk metadata
load, before archived rows are filtered. Cycle members and incoming
descendants share a deterministic representative; no extra IPC, disk
reads, or persisted state.
- Compare those roots in the UI, excluding coordinated ancestors,
descendants, siblings, and cousins while still warning about unrelated
families' active sub-agents.
- Retain workspace identity rather than a display name during activity
handoffs, and resolve it against current candidates so navigation into
that agent's family cannot leave a stale warning.
- Replace manual memoized ID collection and repeated metadata lookup
with filtered metadata and a direct active-workspace selection; inline
the single-use warning view. No new timer or effect.
- In a separate CI compatibility commit, recognize Codex's observed
automatic security-review heading without exempting actual findings.

## Validation

- Five same-family cases reproduced the false warning before the fix; a
separate regression reproduced the held-warning leak when switching into
the active agent's child.
- All 232 focused config/warning/workspace-family tests and 1,021
workspace/task service tests pass. Real-config tests cover archived
ancestry, cycle members/incoming descendants in both input orders,
unrelated trees, and non-persistence of derived roots.
- Codex gate tests reproduce the new-heading false positive and verify
that explicit or appended security findings remain blocking.
- Headless Storybook-manager checks passed at 1140px and the existing
pinned 375px phone viewport: one-line warning, ellipsis on phone, no
horizontal overflow or composer displacement.
- Local `make static-check` passes.

## Subtractive ledger

**P1: 61 production lines added, 62 removed; net −1.** The warning fix
is +59/−61 (net −2); the separate CI-format compatibility fix is +2/−1
(net +1). Removed frontend ancestry traversal, manual ID-list
memoization, redundant metadata lookup/fallback, stale display-name
retention, and a single-use view wrapper. Complete family scope is
derived during the existing bulk metadata read, not synchronized through
new state.

## Risks

This changes warning eligibility and adds an optional derived frontend
metadata field, not task execution, isolation, or persisted config.
Unrelated task trees still warn; existing activity smoothing and
unregistered-workspace protection remain intact.

---

_Generated with `xum` • Model: `openai:gpt-6-astra` • Thinking: `xhigh`
• Cost: `$63.33`_

<!-- mux-attribution: model=openai:gpt-6-astra thinking=xhigh
costs=63.33 -->

## Summary

Version bump for the v0.28.5 patch release. Headline changes since
v0.28.4: remote server connections in the desktop app (coder#4101),
self-updating `xum server` under a restart supervisor (coder#4083, coder#4127),
first-class GPT-6 Astra and Astra Pro support including Codex OAuth
routing (coder#4064, coder#4094, coder#4106, coder#4124), token-budget context window
rollovers (coder#4097), the workspace remembering model and mode on send
(coder#3968), in-place plugin updates (coder#4164), the optional flat sidebar chat
list (coder#3994), and copying selected chat text as Markdown (coder#4170). It
also carries a long run of streaming, compaction, and task-lifecycle
fixes (reconnect streaming coder#4123, message edits during active streams
coder#4153, Codex OAuth prompt-cache routing coder#4159, compaction/history
fencing coder#4133 through coder#4148, task lock ordering coder#4161) plus the Effect
Wave 4 runtime refactors and deslop passes 1 through 3.

## Implementation

Bumped with `node ./scripts/set-package-version.js 0.28.5` so the root
`package.json` and the legacy `packages/mux-compat` forwarding package
stay version-locked. `src/common/compat/productIdentity.test.ts` passes
locally (8/8).

After this PR merges, the `v0.28.5` tag will be applied to the squash
commit and the GitHub Release published to trigger the
desktop/npm/docker pipelines.

---

_Generated with `xum` • Model: `anthropic:claude-fable-5-1` • Thinking:
`xhigh` • Cost: `$1.64`_

<!-- mux-attribution: model=anthropic:claude-fable-5-1 thinking=xhigh
costs=1.64 -->