feat(maestro): show only the program on session cards

The command fragment named the full command line, so a session spawned
with `claude --dangerously-skip-permissions` spent the whole line on a
flag. Cards now name the program only — its icon in the web client, its
bare name in the TUI — and keep the full command line in the tooltip.

Adds `maestro_protocol::display::command_program`, the Rust counterpart
of the web's `splitCommand`.

docs/SIDEBAR.md

@@ -88,21 +88,26 @@ of `maestro_protocol::InTheWay`'s `Display` does not disappear: it is the web
 card's tooltip and the wording of the kill refusal, so no two clients describe
 the same tree differently.
 
-`<command>` is unconditional and muted: the session's command line, shown on
-every card in both clients — no omission in the TUI, no name-vs-command
-comparison gating it. A session named by its command line then shows the same
-string on both lines; that is accepted, the price of a row that never changes
-height.
+`<command>` is unconditional and muted: it names the **program** the session
+runs — never its arguments. `claude --dangerously-skip-permissions` renders as
+`claude`. Flags say how a session was invoked, which is not what a card is for,
+and a long one crowds out every other fragment on the line. It shows on every
+card in both clients — no omission in the TUI, no name-vs-command comparison
+gating it. A session named by its program then shows the same string on both
+lines; that is accepted, the price of a row that never changes height.
 
-In the **web client** the command's leading program is replaced by that tool's
-icon when it is one we have a mark for — Claude Code, Codex, opencode, Gemini
-CLI, Aider, Cursor, pi, and any shell — and only the remaining words of the
-command line follow as text. Recognition looks through a path, leading
-`FOO=bar` assignments and wrappers (`sudo`, `env`, `npx`, `pnpm dlx`, …); an
-unrecognised program keeps its full text, so the card never shows a mark
-standing for the wrong tool. The full command line stays in the card's tooltip
-either way. The **TUI** keeps the command as text: a terminal cannot be assumed
-to have a font carrying tool glyphs.
+The program is found by looking through a path, leading `FOO=bar` assignments
+and wrappers (`sudo`, `env`, `npx`, `pnpm dlx`, …), then taking the basename:
+`/usr/local/bin/claude -p hi` is `claude`. A line that is nothing but wrappers
+is shown as written rather than as an empty fragment.
+
+In the **web client** the program is replaced by that tool's icon when it is
+one we have a mark for — Claude Code, Codex, opencode, Gemini CLI, Aider,
+Cursor, pi, and any shell — and nothing follows it as text. An unrecognised
+program keeps its name as text, so the card never shows a mark standing for the
+wrong tool. The full command line, arguments and all, stays in the card's
+tooltip either way. The **TUI** keeps the program as text: a terminal cannot be
+assumed to have a font carrying tool glyphs.
 
 ## Colour per activity state