fix: release managed headless writer on detach

[jiale-wangOwO]

Summary

Fixes #907.

/detach currently clears the Feishu surface route but leaves the daemon-owned managed headless codex app-server alive. That process keeps the Codex thread writer lock, so a local codex resume <THREAD_ID> fails with already has an active writer even after Feishu reports that the surface was detached.

What changed

• Emit a targeted headless.kill after immediate detach of a managed headless instance.
• Release the carrier after an active turn finishes or after the existing detach timeout watchdog forces finalization.
• Only release the instance when no other surface is still attached to it.
• Reuse the existing daemon managed-headless kill path, so other instances and the daemon remain online.
• Update the remote surface state-machine documentation.

Tests

• go test ./internal/core/orchestrator ./internal/app/daemon
• go test ./...
• scripts/check/pre-commit.sh

The full test suite passes. The pre-commit guardrail prints existing repository-wide path warnings but exits successfully with pre-commit: passed.

Reproduction covered

The reported flow is now represented by regression coverage: idle detach releases the managed carrier, delayed/timeout detach releases it after finalization, and a carrier still used by another surface is retained.

[kxn]

Thanks for the fix