fix: resolve medium/low audit findings across backend and frontend

- ctx CLI: validate int() limit arg, wrap FTS5 MATCH in try/except
- ctx.rs: FTS5 error message clarity, Mutex::lock() returns Err not panic
- sdk-messages.ts: runtime type guards (str/num) replace bare `as` casts
- agent-runner.ts: strip ANTHROPIC_* env vars alongside CLAUDE*
- agent-dispatcher.ts: timestamps use seconds (match session.rs convention)
- remote.rs: disconnect handler uses lock().await not try_lock()
- session.rs: propagate pane_ids serialization error
- watcher.rs: reject root-level paths instead of silent no-op
- lib.rs: log warnings on profile.toml read failure and resource_dir error
- agent-bridge.ts: validate event payload is object before cast

v2/src-tauri/src/remote.rs

@@ -226,11 +226,10 @@ impl RemoteManager {
 
             // Mark disconnected and clear connection
             {
-                if let Ok(mut machines) = machines_ref.try_lock() {
-                    if let Some(machine) = machines.get_mut(&mid) {
-                        machine.status = "disconnected".to_string();
-                        machine.connection = None;
-                    }
+                let mut machines = machines_ref.lock().await;
+                if let Some(machine) = machines.get_mut(&mid) {
+                    machine.status = "disconnected".to_string();
+                    machine.connection = None;
                 }
             }
             let _ = app_handle.emit("remote-machine-disconnected", &serde_json::json!({