follow-ups from the v0.11.2 release review (non-blocking)

Start by splitting the eleven follow-ups into separate issues; the current issue spans packages/tui/test/cli/tui/dialog-altimate-base.test.tsx, app.tsx, src/altimate/free/host.ts, workspace-sidebar.tsx, cli/cmd/link.ts, plugin/tui/altimate/workspace.tsx, local.tsx, providers.md, and mergeStartupHistory. Read the named code and tests first, then define a separate, verifiable done condition for each investigation or design task.

Found during the v0.11.2 release review (five-persona pass over v0.11.1..main). None of these block the release; each is deferred because it needs investigation or design work beyond a same-day fix.

1. Flaky packages/tui/test/cli/tui/dialog-altimate-base.test.tsx — fails roughly 1 in 3–4 local runs with a rendering timeout / blank-frame capture, worse when run alongside sibling files. It covers the migration consent dialog, and app.tsx documents this exact area as a multi-signal startup race (kv.ready, promptHistory.loaded(), local.model.ready, dialog.replace() losing a race), so treat it as a possible canary for a real race under load, not just test infra. One focused pass on the file's wait conditions. (CTO)
2. Cross-repo consent trust boundary — the TUI's "registered → migrate silently" branch trusts "registered on this machine" as proof a human accepted the disclosure; src/altimate/free/host.ts itself says the server-side check is a text-version agreement, not proof of consent, and the other registering host (VS Code extension, vscode-altimate-mcp-server) lives outside this repo. Document/verify that every registering host shows the disclosure before calling POST /altimate/base/register. Docs for the per-machine semantics were added in v0.11.2 (providers.md). (Chaos Gremlin, privacy/compliance)
3. workspace-sidebar.tsx renders the server-controlled workspace name without stripControlChars — pre-existing; the CLI path sanitizes rigorously, the opentui path does not. Confirm opentui's cell renderer cannot emit raw escape bytes from text children, or sanitize for symmetry. (CTO, Gremlin)
4. isSafeHttpUrl duplicated between cli/cmd/link.ts and plugin/tui/altimate/workspace.tsx, kept in sync by comment only. Share it. (CTO)
5. Decline durability under double corruption — a decline is stored in kv.json and model.json; if both are lost on an already-registered machine, the user is silently re-migrated. Consider a third signal or a re-prompt when both stores are freshly empty on a machine with existing sessions. (Gremlin)
6. Hard quit right after clicking No can race the async writeJsonAtomic for the decline (matches the file's existing fire-and-forget pattern). (End User)
7. First-run text loss for a genuinely unconfigured user — the prompt gate still discards the typed prompt when it opens the welcome picker (only the kv-hydration race was fixed). Consider stashing and restoring the draft. (End User)
8. mergeStartupHistory has no direct unit test (only indirect full-mount coverage). (Tech Lead)
9. Comment density / inline review history in packages/tui/src/context/local.tsx (~32% comments, 38 marker blocks citing external review-round ids). Extract the migration state machine's invariants into a design doc before the next migration of this shape. (Tech Lead)
10. No docs mention of clickable workspace names (#1274). One line in the CLI/workspaces docs. (PM)
11. altimate-code link always emits OSC 8 bytes on any TTY, gating only the underline on the allowlist; verify Apple Terminal (excluded by name) renders cleanly. (End User)

Related: #1303 (follow-ups from the #1302 review), #1257 (dbt-tools E2E cached-uv flake, hit again on the v0.11.2 head run 34581122233).