Fix drift sync: per-window verdicts, forgiving class match, event-driven status bar

Three independent defects made the focus state feel flaky and let the OS
status bar disagree with the web UI:

- Status file lagged the web by up to a minute: it rendered only on a 60s
  ticker with no hook into state changes. notify() now fans out to multiple
  listeners (AddOnChange) and the writer has a coalesced Wake() so drift
  reaches the bar as promptly as the browser.

- A brief off-task visit could latch drift for the whole session. Sibling
  windows of one app (a browser's reading tab vs its chat tab) share a window
  class, but the judge verdict was cached by class alone, so one tab's verdict
  poisoned the rest and never re-judged. Cache is now keyed by class + scrubbed
  title (judgedWindows) so siblings are judged independently.

- Allowed-class matching was exact equality, so a short token ("brave") never
  matched the real WM_CLASS ("Brave-browser") and every window was routed to
  the LLM. Matching is now substring-based, and planning surfaces the live
  window class with a click-to-add chip so users pick a token that matches.

Also fix the planning checkbox alignment: the global full-width input rule was
stretching the "Enforce focus" checkbox; scope it out for checkboxes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/evidence/context.go

@@ -19,7 +19,10 @@ func windowClassAllowed(ctx domain.AllowedContext, candidate string) bool {
 		return false
 	}
 	for _, allowed := range ctx.WindowClasses {
-		if normalizeCasefolded(allowed) == candidate {
+		// Substring, not equality: a short token a user types ("brave") matches the
+		// longer real WM_CLASS ("Brave-browser"). Equality silently disabled the
+		// fast path whenever the two differed, routing every window to the judge.
+		if a := normalizeCasefolded(allowed); a != "" && strings.Contains(candidate, a) {
 			return true
 		}
 	}

internal/evidence/context_test.go

@@ -19,6 +19,20 @@ func TestWindowClassMatchesCaseAndTrim(t *testing.T) {
 	}
 }
 
+func TestWindowClassMatchesSubstring(t *testing.T) {
+	// Users type a short app name ("brave") but the real WM_CLASS is longer
+	// ("Brave-browser"). The allowed token matching as a substring of the actual
+	// class keeps the local on-task fast path working instead of silently routing
+	// every window to the LLM judge.
+	ctx := domain.AllowedContext{WindowClasses: []string{"brave"}}
+	if !windowClassAllowed(ctx, "Brave-browser") {
+		t.Fatal("short allowed token should match the longer real class")
+	}
+	if windowClassAllowed(ctx, "firefox") {
+		t.Fatal("unrelated class must not match")
+	}
+}
+
 func TestWindowTitleMatchesSubstring(t *testing.T) {
 	ctx := domain.AllowedContext{WindowTitleSubstrings: []string{" antidrift "}}
 	if !windowTitleAllowed(ctx, "Commitment OS - AntiDrift") {