fix: clear the CI reds on main (Mermaid E2E sampling, plan-reminder autofocus, harbor-cell deadline race)

[Astro-Han]

Summary

Three independent failures were keeping main's CI red. Each is fixed at its cause, not by widening a tolerance or adding a retry.

1. Mermaid toolbar offset E2E (e2e_shard 2/2) — the assertion measured the wrong thing. Failing on six consecutive runs across unrelated branches plus two on main, reading 2px or 3px against a <= 1 bound. The offset it measures cannot move: Toolbar is the first flex child of figure.maka-mermaid-diagram, and the figure carries a 1px border, so toolbar.top - figure.top is structurally that border regardless of zoom. The change came from the sampling — the offset was derived from two independent boundingBox() round-trips, and the transcript is a bottom-pinned scroller that re-pins on every ResizeObserver update (use-chat-scroll.ts). Zooming widens the canvas, the viewport gains a scrollbar, mermaid-diagram.tsx recomputes viewportHeight on the next frame, the figure changes height, and the scroller re-pins — landing between the two samples and turning scroll drift into a phantom offset. Both the toolbar offset and the viewport height are now read inside one evaluate, and the comparison polls for the steady state instead of the frame right after the click. The 1px tolerance is unchanged.

2. Plan-reminder edit dialog (e2e_shard 1/2) — a real product regression. #2002 rebuilt the dialog's title row as a bare <input autoFocus> inside a Field, replacing a TextInput with hasAutoFocus. Astryx's Dialog picks its initial focus target by querying [data-autofocus] after showModal(), and its own source documents why React's autoFocus cannot work there: it calls .focus() during commit, while the dialog is still invisible, so the focus silently fails. TextInput emits data-autofocus; the bare input did not, so opening 编辑提醒 left the caret on the close button instead of the title field. Moved onto the same seam. The E2E was reporting a genuine bug.

3. Harbor-cell force-stop test (test_headless) — a race, not a flake. The test asserts the deadline stops an active isolated tool, but established that precondition by giving the cell 1000ms of wall clock to finish setup, create the session, and drive the first send before the timer fired. Lose that race and the run is still cancelled by benchmark.deadline — settledByDeadline stays true — while the backend is never stopped, so stopModes is empty. Setup costs ~100ms locally; on a loaded runner it can exceed the budget. The setup budget is now 3000ms and the precondition is asserted directly, so losing the race reports "the isolated tool never started within the budget" instead of a bare deepEqual mismatch.

Closes #2000

Root cause evidence

• Add Rive workflow Maka tool #1 is a structural argument: toolbar.top - figure.top is a constant by construction, which makes any non-zero delta a sampling artifact. Not reproduced live — see Verification.
• Harden runtime, storage, gateway, credentials, and IPC inputs #2 is confirmed by Astryx Dialog.tsx:443-452, which both implements the [data-autofocus] seam and documents the React autoFocus failure mode, plus the git show of redesign(ui): rebuild the plan-reminder form as a grouped-row panel #2002 replacing hasAutoFocus with autoFocus.
• Extract runtime kernel boundaries and durable AgentRun recovery #3 is reproduced: forcing the ordering with a 1ms deadline yields the exact CI signature, actual: [] vs expected: [ 'immediate' ]. Restoring the ordering makes it pass.

Verification

• Full CI green on this branch (run 30811370682): both E2E shards, test_headless, test_workspaces, typecheck, alignment_audit.
• Full headless suite locally: 1305 tests, 0 fail.
• The new headless guard was exercised in both directions — passes normally, and fails with its intended message when the race is forced.
• @maka/ui typecheck and Biome clean on the touched files.
• E2E could not be run locally: this environment has no window server, so Electron launches but firstWindow() times out. CI is the verification for Add Rive workflow Maka tool #1 and Harden runtime, storage, gateway, credentials, and IPC inputs #2.