fix(crit): open remote reviews over Tailscale

[NicholasZolton]

Summary

“Open in Crit” silently opened nothing when the remote environment was connected over Tailscale rather than SSH. The client omitted forwarding, so Crit tried to open a browser on the server. Reconnecting could also change the active route without changing the preferred saved route.

Open tailnet reviews through temporary, review-owned HTTPS endpoints and choose forwarding from the actual connected route. Crit stays on loopback; closing the review removes only its endpoint. Permission failures can retry with non-interactive sudo when an existing Tailscale file share requires elevated access. Local and SSH/Portless reviews keep their existing paths; unsupported remote routes now report an error instead of silently succeeding.

Test plan

• Focused server tests: concurrency, endpoint cleanup, direct/sudo publication, failure cleanup, existing scope and SSH forwarding behavior (9 tests).
• Client route-selection tests, including reconnect/fallback and web primary origins (6 tests).
• Web/server typechecks, targeted lint, formatting, and wiki validation.
• Two real concurrent Crit reviews on the remote host returned HTTP 200 over separate tailnet HTTPS endpoints. Cleanup preserved the existing Serve configuration and T3 environment identity.
• macOS arm64 desktop artifact rebuilt successfully from the merged main checkout.
• Remote runtime deployed through the existing notification-credential launcher; loopback and the original tailnet HTTPS origin both return the same environment identity, with existing publications preserved.
• Installed Mac-client button clickthrough: requires restarting into the rebuilt app. No UI layout or styling changes.

Rollout note

The remote runtime is updated, and the installed Alpha app points at the rebuilt main-checkout artifact. Restart the Mac app to use the new client. Review endpoints are tailnet-only, not Funnel or T3 Connect publications.

The standard remote helper refused this externally launched server. Deployment instead verified its exact PID and staged binary, retained the existing launcher and notification-credential wrapper, and preserved the backend port, public HTTPS origin, and environment identity, with rollback available. No server data migration or credential changes were needed.

brave-tulip-laurel