Cheap LFS materialize cancel/summary fixes from verified bug audit / 大檔還原取消同總結修正

[DingDingChae]

What changed / 改咗啲乜

A multi-agent bug audit of the last fifteen commits (nine finder lenses; every finding adversarially verified by three independent reviewers) confirmed seven defects. This task fixed the three user-facing Cheap LFS materialize-flow bugs in commit e3fb8c8664, merged with the concurrent legacy-deletion guard work in 7274960257:

• Cancel now reaches queued batches. Materialization owners register per repository from enqueue time, so canceling Materialize all aborts every pending batch — including an automatic restore enqueued by a concurrent fetch/pull that previously took over the queue slot and restarted the just-canceled downloads. Single-file cancels stay scoped to their own request signal.
• Honest completion reporting. The batch resolves with a summary (per-file failures now carry messages plus batch total bytes) and the Large files panel reports "Materialized N files; M files failed and were left as pointers." instead of unconditionally claiming success.
• No stale list after cancel. A canceled Materialize all reloads the pinned-file list, so completed files no longer keep a stale pointer state (which had also suppressed the local-deletion warning on Remove).

撳「全部還原」嘅取消掣，宜家成個 repo 排緊隊嘅批次都會一齊停低；面板會照實報告失敗數目；取消之後清單即刻重新載入，唔會留低過時狀態。

Verification / 驗證

• tsc --noEmit, ESLint, and Prettier clean on every touched file.
• app/test/unit/cheap-lfs 298/298, ui/cheap-lfs-test.tsx 20/20 (three new behavioral tests), submodule-mutation-guard-test.ts 7/7, submodule-repository-navigation-test.ts 21/21 — the last two were already failing at the previous HEAD against an outdated dispose-map shape and were repaired here. Post-merge rerun: 349/349.
• Post-push runs (reported while still executing, per the async-CI policy): CI 30064488786, CodeQL 30064488816, Pages 30064488820; Cheap LFS cloud compression 30064488836 already completed.

Remaining work / 未做嘅嘢

Verified but not yet fixed: non-deleted .git* selections with a symlinked parent or multi-link leaf still fail the whole commit via an unhandled CheapLfsTrackedPathError (the merged legacy-deletion guard covers the deleted-path case); maybeAutoMaterializeCheapLfs awaiting the full per-checkout queue can stall awaited repository-selection chains; the cloud-compression action rejects documented-valid exactly-2-GiB legacy parts and lacks a stdin error listener. Details in HANDOFF.md.