Follow-up lifecycle and security fixes

[OneNoted]

Summary

• resolve surface agent-start by the surface's current workspace/pane so moved shells keep correct lifecycle state
• add a moved-surface regression test for agent-start handling
• raise the direct tar floor to 0.4.45, switch taskers-ghostty to the workspace dependency, and update the lockfile to tar 0.4.45 and rustls-webpki 0.103.10
• clear the current RustSec/dependency audit findings while folding in the open tar security update

Testing

• cargo audit
• cargo test -p taskers-control --lib -- --nocapture
• cargo test -p taskers-cli --bin taskersctl -- --nocapture
• cargo test -p taskers -- --nocapture
• cargo test -p taskers-ghostty --lib -- --nocapture
• cargo install --path crates/taskers-app --force

Supersedes #3 for the tar bump.