Rebase MISTER EXO's ida-codemode port onto the current tree

Mechanical part of the port: the 27-file patch was cut against a base ~148
commits behind us, so it did not apply. Resolved 11 conflicts (all of them
diff drift, not semantic clashes) and the three file deletions:

- app.py: the patch re-inserted _do_rename/_do_name_addr/_seek_split etc. as
  "theirs" because our tree moved them to edit_ctl.py/trace_ctl.py. Kept ours
  and applied the real intent (WorkerClient->CodeModeClient, .call->.invoke,
  _open_worker_client->_open_database_client) at their current homes.
- domain.py: kept Head as a NamedTuple -- the patch reverted it to a frozen
  dataclass, which the perf work measured at 2.9us vs 1.9us per row on a
  quarter-million-row walk. Dropped _fetch_output (no download_url under Code
  Mode) and its now-dead urllib/json imports.
- pane.py: the patch's deletion swallowed our zellij support along with the
  worker-reaping block it meant to remove. Kept zellij, removed the reaping.
- test_scenarios.py: the idb_save->save_database teardown hunk belongs to
  tests/_fixtures.py in our tree; applied it there and kept our pc_num_format
  scenario that the drift landed on.

Three defects in the patch itself, fixed here:

- It made "import idatui" hard-require ida_codemode, so every offline suite
  died at import -- including the pure ones (graph/index/trace) that are the
  house rule for "tests/run.py --fast". The import is now deferred and gated
  on the binding, which is also what lets the port's own contract tests
  inject a fake DatabaseHandle.
- project.stage() inlined an ida_codemode.registry import and treated "library
  not installed" as "someone owns this database", which broke IDA-free project
  staging. Ownership lookup moved to codemode_client.database_owner().
- tests/test_codemode_client.py had no NEEDS_IDA marker, which tests/run.py
  rejects outright.

Offline suite: 301 passed, 0 failed. Against master's 344 the whole delta is
accounted for: -40 worker_client (module deleted), -18 launch sweep checks
(behaviour deliberately removed) +3 guarding that it stays removed, +2 pool
(GUI-save semantics), +13 new codemode_client contract tests.

NOT yet done, and the port is not functional without it: the adapter is
missing five operations our tree grew since the patch's base (flowchart,
op_format, pc_nums, pc_num_format, survey_binary) and its "heads" predates
back-walking and digest/expect.

1 files changed, 21 insertions, 7 deletions

diff --git a/idatui/project.py b/idatui/project.py
index e2fc542..53f3b0a 100644
--- a/idatui/project.py
+++ b/idatui/project.py
@@ -23,7 +23,8 @@ firmware image, a cleaned build tree).
 A source whose size/mtime no longer matches the staged copy is re-staged, and its
 now-stale database is dropped (the DB describes the old bytes).
 
-stdlib-only, like the domain/worker layers — the TUI is the only Textual consumer.
+The model has no IDA imports. Staging consults ida_codemode's registry before
+replacing files so it never mutates a database owned by a GUI/shared worker.
 """
 from __future__ import annotations
 
@@ -56,7 +57,7 @@ class BinaryRef:
     #: it is, a raw firmware image doesn't, and IDA defaults to metapc at 0.
     processor: str = ""   # IDA processor name: arm, armb, mipsb, metapc, …
     base: int = 0         # load address (natural, e.g. 0x8000000)
-    ida_args: str = ""    # escape hatch: extra IDA command-line switches
+    ida_args: str = ""    # legacy -p/-b/-T switches accepted by Code Mode adapter
 
     @property
     def db(self) -> str:
@@ -310,13 +311,25 @@ class Project:
         """Ensure ``ref`` is staged in the sidecar; returns the staged path.
 
         Re-staging a changed source drops its database: the DB describes the old
-        bytes, so keeping it would silently mismatch the disassembly (any renames
-        in it are lost, which is why callers should say so out loud).
+        bytes. Refuse while Code Mode reports a GUI/idalib owner; replacing a
+        staged executable or IDB underneath a shared live instance is corruption.
         """
         if not os.path.isfile(ref.source):
             raise ProjectError(f"no such binary: {ref.source}")
         if not self.is_stale(ref):
             return ref.staged
+        try:
+            from .codemode_client import database_owner
+            owner = database_owner(ref.db, ref.staged)
+        except Exception as exc:
+            raise ProjectError(
+                f"cannot verify Code Mode ownership before staging {ref.label}: {exc}"
+            ) from exc
+        if owner is not None:
+            raise ProjectError(
+                f"cannot restage {ref.label}: Code Mode instance {owner.record_id} "
+                f"still owns {owner.idb_path}; close/release it first"
+            )
         os.makedirs(self.bin_dir, exist_ok=True)
         tmp = ref.staged + ".staging"
         _unlink(tmp)
@@ -338,10 +351,11 @@ class Project:
         return out
 
     def sweep_scratch(self, ref: BinaryRef) -> int:
-        """Delete IDA's unpacked working files (never the ``.i64``) for ``ref``.
+        """Delete unpacked working files (never the ``.i64``) for maintenance.
 
-        A hard-killed worker leaves them behind and the database then refuses to
-        reopen. Only safe when no worker holds it.
+        Runtime paths no longer call this: Code Mode instances are shared, so a
+        registry owner may still be using these files. Callers must independently
+        prove that no GUI/idalib instance owns the database.
         """
         return sum(1 for suf in SCRATCH_SUFFIXES if _unlink(ref.staged + suf))