Replace the footer's placeholder usage with a real observation ledger

The footer showed invented percentages. It now shows what two harnesses
actually report, or says it does not know.

lumbridge-core gains an append-only per-profile UsageLedger and a projection
that labels every derived value estimated, withholds a burn rate from a single
sample, withholds a window fraction with no reported ceiling, withholds an
exhaustion estimate that lands after the reset, and reports an expired window
as rolled over rather than freezing its last percentage. A missing fact renders
as missing, never as zero. (0012)

lumbridge-harness is the impure side: processes, clocks, and untrusted wire
text in, observations out. Three adapters:

- Codex's account/rateLimits/read over the app-server's JSON-RPC stdio. The
  client cannot express a request outside a two-variant enum and answers every
  server-to-client request with -32601, so a harness asking Lumbridge for a
  credential is refused by construction. (0013)
- Claude Code's session transcripts, as a byte-offset tail follower that
  reports nothing until the backlog is read to EOF — a partially-read backlog
  is indistinguishable from a burst of spend, and the first run against 20 MB
  reported forty-six billion tokens an hour. The parser models four counters,
  so the conversations in those files are not representable. (0014)
- Claude Code's five-hour and seven-day subscription windows, via a bridge
  installed as its statusLine command. 0014 had claimed no such surface
  existed; it does, and the record is corrected in place rather than quietly
  edited. Lumbridge does not read the OAuth credential to call the account
  usage endpoint, which is what comparable tools do — AGENTS.md forbids it,
  and 0015 says so rather than leaving the gap unexplained.

Also in here: a capability-check ordering fix in the workspace reducer, where
the applied-request replay table was consulted before the capability check and
so answered questions the caller had no right to ask; the GPUI spike wired to
the live probes with per-harness gauges and provenance chips; and a launcher
that matches its own window by PID, because GPUI sets WM_NAME but not
_NET_WM_NAME and a title match never succeeded.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

spikes/ui-shell-model/src/lib.rs

@@ -205,8 +205,17 @@ pub const WORKSPACES: [&str; 5] = [
     "ACP adapters",
     "Usage telemetry",
 ];
+/// Static footer strings retained only by the Floem comparison shell.
+///
+/// These are layout fixtures, not usage. They are not a usage source and must
+/// not be rendered as one: the GPUI shell now derives its footer from
+/// `lumbridge_core::UsageLedger`, where every value carries a provenance and a
+/// missing fact renders as missing. Delete these once Floem consumes the ledger
+/// or the candidate is retired. See decision 0012.
 pub const FOOTER_LEFT: &str = "6 panes · 3 remote · 1 needs input";
+/// See [`FOOTER_LEFT`]: a layout fixture, not a usage reading.
 pub const FOOTER_CENTER: &str = "Codex · ChatGPT subscription · 62% window remaining";
+/// See [`FOOTER_LEFT`]: a layout fixture, not a usage reading.
 pub const FOOTER_RIGHT: &str = "burn 8.4%/hr · resets in 2h 14m";
 
 #[derive(Clone, Debug, Eq, PartialEq)]