fix(sync): skip command envelopes when deriving session titles

[samzong]

What's changed?

• is_noise_first_message now tests one list of harness-written openers instead of three hard-coded starts_with calls, and covers the prefixes that actually appear in transcripts: <command-name>, <system-reminder>, <tool_use_error>, [Request interrupted, skill preambles, and resumed-session banners.
• Two regression tests: a <command-name>-led command envelope, and a skill preamble.
• Cargo.lock: h2 0.4.14 -> 0.4.16 for RUSTSEC-2026-0258.
• .github/workflows/release.yml: drop a stale comment about release-please creating the tag, which no longer applies after dad8eba.

Why

• The filter only matched <command-message>, but Claude Code writes <command-name> first, so starts_with never fired and the raw slash-command envelope became the session title. The existing test asserted the reverse tag order, which is why the gap never surfaced.
• Measured against a local index of 6,953 sessions: 359 titles were harness noise rather than intent — 255 from <command-name> envelopes and 104 from skill preambles. Those sessions are effectively unfindable by title in both search results and the TUI list.
• Sessions whose user messages are all noise still fall back to the first message, so none of them regress to Untitled.
• h2 ships in the same branch because the audit stage of make check fails without it (advisory published 2026-08-17), so this branch could not go green on its own. Cargo.lock was edited in place rather than via cargo update, which would also have reshuffled nine windows-sys references unrelated to this fix.

Verification

• make check -> All checks passed (fmt --check, clippy -D warnings, cargo audit, full workspace test suite: 437 passed / 0 failed).
• Re-synced one project with sync --force: among sessions whose source files still exist, noise titles went 10 -> 1. The remaining one is a session whose only user message is /clear, where falling back to the first message is the intended behavior. Sessions whose source transcripts were deleted from disk cannot be backfilled, since titles are derived at sync time.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.