fix: harden JetBrains AI helper control

[tom-sapletta-com]

Implements ticket-010. Fixes false JetBrains JVM discovery, adds read-only-by-default AI plugin/helper control with exact PID identity checks, and preserves all IDE windows. Validation: 535 passed, 5 skipped, 16 deselected; governance 0/0.

[ifuri-validator-agent]

Deterministic Validator approval for exact head d500e3f6dc17673774fe2cd07a9ac233866f5af8.

Ticket: ticket-010
Correlation ID: fixos-ticket010-20260820
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 4
Advisory LLM verdict: REQUEST_CHANGES
Advisory summary: Reviewed all 4 diff chunk(s). Read-only-by-default CLI for JetBrains AI plugin/helper control with exact PID identity checks and conservative safety errors. Code validates config directories under JetBrains paths, uses terminate() not kill, and requires --apply to make changes. | This chunk adds AI plugin control (read-only status, atomic disable writes) and identity-verified Qoder helper termination to jetbrains_ai.py, plus corrects JetBrains main-process discovery in jetbrains_recovery.py to use launcher identity rather than arbitrary command arguments. The atomic write implementation is sound with fsync, temp-file cleanup, and mode preservation. Helper termination revalidates PID+create_time identity before sending TERM and gracefully waits, avoiding main-JVM termination. No security issues identified; process termination is explicitly gated behind --apply and identity checks. | Ticket metadata and CLI tests look consistent with the declared intent. Tests are reported as passing. However, this chunk exposes hardcoded live PID values and a localized confirmation string, and the diff is incomplete within the test file, so full semantic validation of the apply path and identity routing cannot be completed from visible code alone. | Visible chunk adds unit tests for JetBrains AI service control and main process detection edge cases. Tests verify plugin preservation behavior, exact Qoder PID termination, and bash process exclusion from main IDE detection. All test results pass.
Advisory findings: LLM verdict was REQUEST_CHANGES
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-010-2448
TICKET ticket-010
HEAD_SHA d500e3f6dc17673774fe2cd07a9ac233866f5af8
CORRELATION_ID fixos-ticket010-20260820
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test-summary=PASS","test-fedora=PASS","test-arch=PASS","test-ubuntu=PASS","test-debian=PASS","test-alpine=PASS","test (3.12)=PASS","test (3.10)=PASS","governance / remote lifecycle=PASS","test (3.11)=PASS"]
INPUT required_checks = ["test (3.10)","test (3.11)","test (3.12)","test-summary"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "REQUEST_CHANGES" MODEL "openrouter/z-ai/glm-5.2"
ASSERT VERDICT_AUTHORITY != "ADVISORY"