fix: resolve ~50 CodeQL alerts — unused, injection, type issues
unused-local-variable / useless-assignment (~30 alerts):
- mcp-client: manager.ts (11), connection.ts (3)
- acp-link: server.ts (4), rcs-upstream.ts
- remote-control-server: 10 files (SessionDetail, acp/client, transports, etc.)
- src: constants/tools.ts, attribution.ts, win32.ts, main.tsx, attachments.ts
log-injection (2):
- chromeNativeHost.ts, rcs-upstream.ts — apply sanitizeLog()
indirect-command-line-injection (4):
- imagePaste.ts: convert shell:true to explicit sh -c pattern
use-before-declaration (4):
- query.ts, claude.ts, tools.ts, attachments.ts — move feature() import up
comparison-between-incompatible-types (2):
- ExitPlanModePermissionRequest.tsx, useTerminalNotification.ts
shared: sensitive.ts — sanitizeLog() helper
76c47956dd