Check that build-only runs don't replace a tagged app the user is running

Before you resume a shared build queue that compiles into the same DerivedData as a tagged dev app the user is running, read the build script's build-only path. In cmux's reload.sh, build-only stages into a separate temp bundle and skips the tag-state publish and the quit/pkill of the tagged app ('must not mutate the active bundle'). Only a full reload moves the staged app over the final path and quits the running one. So validation compiles can keep running safely while the user tests the last full reload. grep for BUILD_ONLY around the final mv, and around any pkill or osascript quit.