Gate unsafe optional tmux features independently

[tony]

Keep ordinary operations, workspace builds and MCP startup on tmux 3.3a while refusing unsafe optional operations before their effects. This is stacked on the core minimum change.

Operation	Required tmux
Ordinary subprocess operations, polling, workspace and MCP baseline	3.3a
Named buffer deletion/rename and managed paste, whose cleanup needs them	3.4
Captured run-shell output (existing refusal, unchanged)	3.5
Managed control: Server.control, ControlClient.attach, watches, mirrors, streams, live views	3.7

Exact 3.7 also refuses raw break-pane and unnamed Pane.breakOut(); breakOut(name) keeps its post-break rename. Literal split-window -p is refused on 3.4 (typed percent keeps -l N%). Names with . or : are refused on exactly 3.7 before dispatch. Literal select-layout below 3.4 must name a layout or carry tmux's checksum, because 3.3a ends the server on anything else. A single-pane break that prints no id before 3.6 is read back from the moved pane. Direct paste-buffer -d -b stays available on 3.3a.

Control acquisition decides on the daemon before any control client exists, with the hook-free probe and the release-train order next-X.Y < X.Y-rc < X.Y-rcN < X.Y < X.Ya: next-3.7 and 3.7-rc2 do not qualify, 3.8-rc2 and next-3.8 do. It then reads the identity by subprocess (run-shell -C, one word: version, pid and start time joined by commas, the socket path last in single quotes with its quotes reopened), pins the socket through a hard link in a private 0700 directory on the socket's filesystem (alias under 103 bytes, removed on close, EOF or failed attach), rereads the identity through the pin, attaches with -N to the alias, and rereads it again by subprocess after the attach. Nothing is read over the control line: run-shell -C reports through stderr, which a control reply does not carry. A custom ControlCarrier must implement pinSocket; the default refuses.

Subprocess and polling paths are untouched below 3.7. The guards live in one place, TmuxFeatures, applied after the version check to the literal commands a request carries (full verbs, aliases and unambiguous prefixes, flag clustering, --), so typed calls, raw commands, flat batches and handle batches all pass through it and a refused batch runs none of its commands. Opaque programs (if-shell bodies, source-file, shell text, alias contents) keep native semantics, and no second script parser is added.

The workspace CLI requires TMUX_OPTIONAL_FEATURE_POLICY_VERSION >= 2 of the Python libtmux next to its 3.3a floor, in the probe and again in the child, before external code runs. CI qualifies tmuxp 1.74.0 with the Python libtmux source of the Python libtmux feature change at 54b277bb673e208820fc9c795abe4444e2ded272; that overlay is not a released package pair.

Validation, on this Linux/WSL host:

• The whole real-tmux integration lane passes on 3.3a, 3.5, 3.7 and master (next-3.9, which now runs the control cases); control-positive cases carry the control tag and run on every daemon that qualifies, and every lane asserts the refusal and that no client attached. The unit suites of :libtmux, :libtmux-junit5, :libtmux-kotlin, :libtmux-scala-cats and :libtmux-workspace, and the documentation checks, pass; the workspace CLI ExecutionTest passes with the source overlay.
• Deliberate breaks: removing TmuxFeatures.require from the version check fails three OptionalFeatureIntegrationTest cases on 3.3a (named buffers, managed paste, layouts). Making the control floor a no-op fails ControlFloorIntegrationTest on 3.5 ("Expected UnsupportedFeatureException to be thrown, but nothing was thrown"). A table-driven ControlFloorVectorsTest holds the floor to the canonical version vectors; making the floor refuse development and candidate builds again fails it ("3.8-rc ==> expected: true"). Reading the daemon with display-message again in the acquisition recheck fails the hook case on 3.7 ("acquisition ran the hook").
• ControlAcquisitionIntegrationTest also covers a socket path with a space, a quote and a comma, a long socket path through the short alias, replacement of the original pathname after pinning, and the hook staying quiet through qualification and recheck while a control display-message fires it.

Exact 3.7 rejects . and : in session and window names; Names.require refuses them before dispatch for new-session, new-window, rename-session and rename-window (and for workspace window names before staging), with a real-lane case and a recorded break. Not done or not qualified: On a local tmux 3.8 build ServerMirrorIntegrationTest.aRebuildThatFindsNothingNewPublishesNothing fails (a control-mirror case that the preview lane now reaches); it was not diagnosed. Tmux 3.4, 3.6 and the 3.7 patch releases were not run locally and are CI qualification, as is macOS. Once a client is attached, control replies are framed with display-message markers; that is the client's own traffic and still fires a user's after-display-message hook. Reads that print a version with display-message inside a checked call are unchanged. Linux evidence does not establish pinning on macOS. Clojure draft PR20 is a separate follow-up.

Closes #68.