fix(electrobun): address all 20 Codex review findings

CRITICAL:
- PTY leak: Terminal.svelte now calls pty.close on destroy, not just unsubscribe
- Agent session cleanup: clearSession() removes done/error sessions, backend
  deletes after 60s grace period

HIGH:
- Clone branch passthrough: user's branch name flows through callback
- Circular imports: extracted rpc.ts singleton, broke main.ts ↔ App.svelte cycle
- Settings wired to runtime: Terminal reads cursor/scrollback from settings
- Security disclaimer: added "prototype — not system keyring" notice
- ThemeEditor: fixed basePalette → initialPalette reference

MEDIUM:
- Clone race: UUID suffix instead of count-based index
- Silent failures: structured error returns from PTY handlers
- WebKitGTK mount: only current + previous group mounted
- Debug listeners: gated behind DEBUG, cleanup on destroy
- NDJSON residual buffer parsed on process exit
- Codex adapter: deduplicated tool_call/tool_result
- extraEnv: rejects CLAUDE*/CODEX*/OLLAMA* keys
- settings-db: runMigrations() with version tracking
- active_group: persisted via settings.set

LOW:
- Removed dead demo code, unused variables
- color-mix() fallbacks added

ui-electrobun/src/bun/index.ts

@@ -73,12 +73,16 @@ const rpc = BrowserView.defineRPC<PtyRPCSchema>({
       },
 
       "pty.write": ({ sessionId, data }) => {
-        if (!ptyClient.isConnected) return { ok: false };
+        if (!ptyClient.isConnected) {
+          console.error(`[pty.write] ${sessionId}: daemon not connected`);
+          return { ok: false };
+        }
         try {
           ptyClient.writeInput(sessionId, data);
           return { ok: true };
         } catch (err) {
-          console.error(`[pty.write] ${sessionId}:`, err);
+          const error = err instanceof Error ? err.message : String(err);
+          console.error(`[pty.write] ${sessionId}: ${error}`);
           return { ok: false };
         }
       },
@@ -87,21 +91,27 @@ const rpc = BrowserView.defineRPC<PtyRPCSchema>({
         if (!ptyClient.isConnected) return { ok: true };
         try {
           ptyClient.resize(sessionId, cols, rows);
-        } catch { /* ignore */ }
+        } catch (err) {
+          console.error(`[pty.resize] ${sessionId}:`, err);
+        }
         return { ok: true };
       },
 
       "pty.unsubscribe": ({ sessionId }) => {
         try {
           ptyClient.unsubscribe(sessionId);
-        } catch { /* ignore */ }
+        } catch (err) {
+          console.error(`[pty.unsubscribe] ${sessionId}:`, err);
+        }
         return { ok: true };
       },
 
       "pty.close": ({ sessionId }) => {
         try {
           ptyClient.closeSession(sessionId);
-        } catch { /* ignore */ }
+        } catch (err) {
+          console.error(`[pty.close] ${sessionId}:`, err);
+        }
         return { ok: true };
       },
 
@@ -227,7 +237,9 @@ const rpc = BrowserView.defineRPC<PtyRPCSchema>({
           }
 
           const cloneIndex = existingClones.length + 1;
-          const worktreePath = `${mainRepoPath}-wt-${cloneIndex}`;
+          // Fix #8: Use UUID suffix to prevent race conditions between concurrent clones
+          const wtSuffix = randomUUID().slice(0, 8);
+          const worktreePath = `${mainRepoPath}-wt-${wtSuffix}`;
 
           const gitResult = await gitWorktreeAdd(mainRepoPath, worktreePath, branchName);
           if (!gitResult.ok) {