(remote): light a pip while a remote session writes

[devsuitup]

The watch channel from #241 already parses every transcript event into
{ kind: 'project', rel } and threw rel away. That signal arrives in real
time — measured against the live host, one remote session answering a single
question produced 19 of them over nine seconds — and fed nothing visible.

This puts it on screen: a pip that lights while a remote session is writing its
transcript, and goes out on its own when it stops.

Two callbacks, deliberately unequal

start(alias, onEvent, onActivity).

• onEvent stays coalesced at 15 s. It opens an ssh cycle, so it must be.
• onActivity fires on every project event, uncoalesced. It costs no
  connection and no disk — only a map write and, at most once a second per
  session, one small IPC message.

Routing activity through the coalesced path would have pinned the pip to the
15 s refresh rhythm, which is exactly what makes it useless as an activity
indicator. kind: 'session' never reaches it: a descriptor rewrite is a status
change, not writing.

Nothing rebuilds the sidebar

The renderer gets { alias, sessionId, at } and updates that one row. No
projects rebuild, no morphdom pass — the whole point is that an event costs
nothing. The pip clears 20 s after the last event for that session, one timer
per session, reset on each event, and dropped when the row goes away.

A rebuild for other reasons still paints the pip correctly: remoteActiveAt
rides along on the session object, so a fresh launch or an unrelated refresh
does not blank an active session.

The decision itself lives in remote-activity.js — a pure module the main
process wires thin, testable directly rather than through a replica.

One defect fixed on top of the original commit

The IPC throttle map kept one entry per session it had ever seen, for the life
of the process, while the sightings map was pruned. Both now age out of the
same window, pinned by a test that fills 50 sessions and asserts both maps
shrink to one. Removing the prune turns it red.

Verification

Mutations, each breaking only its own test: the onActivity call dropped; the
kind === 'project' guard removed; the session-id check relaxed; the IPC
throttle removed; the decay prune disabled; the renderer's decay delay changed;
the initial-paint comparison inverted; the throttle-map prune removed.

One real bug surfaced by the tests and fixed before it shipped: both the
throttle check and activeAt used map.get(k) || <default>, which collapses a
legitimate 0 timestamp to "absent". Invisible with a real clock, immediate
once the injected clock started at zero.

task check: 1202 pass, 0 fail, 8 pre-existing skips, lint 0 errors.

Not verified: the pip's colour was chosen by inspection against the existing
dot palette, not looked at in a running window.