GeezerVison

why: The reattach loop reached for libtmux's `Server.cmd()` escape
hatch to invoke `tmux display-message -p '#S'` for the session
name, even though libtmux has exposed a typed
`Pane.display_message()` wrapper for this exact subcommand for
several releases. With libtmux 0.56.0 now in the dependency tree
(it broadens `display_message`'s flag coverage on top of the
existing get_text path), there's no remaining reason to keep this
particular cmd() escape.

what:
- Replace `builder.session.cmd("display-message", "-p", "'#S'")`
  in `_reattach()` with
  `active_pane.display_message("'#S'", get_text=True)` against
  `builder.session.active_pane`. Same tmux invocation under the
  hood; typed call site instead of stringly-typed positional args.
- Add a narrowing assert on `active_pane` (returns `Pane | None`
  in libtmux's typing) so mypy can prove the call site is
  well-typed. Mirrors the existing `assert builder.session is not
  None` pattern at the top of `_reattach()`.
- Iterate the returned `list[str]` directly. Previously the loop
  consumed `proc.stdout` (a list), so the iteration shape is
  identical and the per-line `tmuxp_echo` / `logger.debug` body
  is unchanged.

No behavior change: the active pane is what tmux's display-message
defaults to anyway when no `-t` is passed, so the underlying tmux
invocation is byte-for-byte identical.

why: Six tests in the plugin-system suite were querying tmux for
session/window names via the same `session.cmd("display-message",
"-p", "'#S'")` escape hatch that production just migrated away
from in `cli/load.py:_reattach`. Keeping the tests on the typed
wrapper that production now uses keeps the call shape consistent
across the codebase and removes the last `cmd("display-message",
...)` site from the repo.

what:
- `tests/cli/test_cli.py::test_reattach_plugins`: replace the
  `cmd()` call with `active_pane.display_message("'#S'",
  get_text=True)` so the post-reattach assertion uses the typed
  wrapper.
- `tests/workspace/test_builder.py`: migrate four
  `test_plugin_system_*` checks (`before_workspace_builder`,
  `on_window_create`, `after_window_finished`, and the
  multi-window variant covering both `before_script` and
  `after_window_finished`) onto `active_pane.display_message()`.
  The multi-window variant hoists the active_pane lookup once and
  reuses it for both the `'#S'` and `'#W'` queries.
- Each call site adds a narrowing assert on `active_pane`
  (libtmux types it as `Pane | None`) so mypy can prove the call
  is well-typed. Mirrors the production assert added in
  `_reattach()`.

No behavior change: tmux's `display-message` defaults to the
session's active pane when no `-t` is passed, so the underlying
tmux invocations are byte-for-byte identical to the prior
`session.cmd(...)` calls.