fix: accept empty-data final exec_chunk to complete the waiter

[blaspat]

Summary

Fixes the server-side half of the exec disconnect on workmac.

The node streams exec_chunk messages; the final chunk (more=false) carries empty data by design — its payload is the exit_code / status / duration_ms / truncated metadata, not output bytes. But _handle_exec_chunk rejected empty data before reading the more flag, so every exec's completion metadata was dropped.

Result (confirmed from audit.log + server logs):

• exec_chunk ... missing or invalid data warning on every exec
• the waiter never completes cleanly → the connection tears down right after each exec (close 1006 (abnormal closure): unexpected EOF)

Change

wsserver/server.py — read more first, then only require non-empty data for intermediate chunks (more=true). An empty-data final chunk now decodes to b"" and completes the waiter with its metadata.

more = raw.get("more", True)
data_b64 = raw.get("data")
if not isinstance(data_b64, str) or (not data_b64 and more):
    ...  # reject

Test plan

• 3 new regression tests in tests/test_exec_chunk.py:
  • empty-data final chunk after an intermediate chunk → waiter completes with metadata + assembled output
  • empty-data final chunk as the only chunk (zero-output command) → waiter completes, empty temp file
  • empty-data intermediate chunk is still rejected → no chunk state created, waiter stays pending
• pytest -q → 49 passed
• ruff check → clean

Related

• Go side already merged: blaspat/hermes-node#121 (demuxer tail more=true) and #122 (NoResponse ordering). This PR completes the pair — without it the final chunk's metadata is dropped.