chore: sync with upstream pingdotgg/t3code main

[yordis]

• Upstream absorbed the anchored-end-space clamp and the normalised padding record from divergence 0012, so the fork takes upstream's copy of the list patch as the base and 0012 is narrowed to the padding-restore hardening it still carries alone.
• The list patch is regenerated against the pristine package rather than hand-merged, because hand-merging hunk offsets in a generated patch yields a patch that no longer applies.
• Divergence 0003's MCP tool-payload fallback is dropped for upstream's narrower condition, since upstream's version still delivers the record the subagent reader needs.
• The provider hydration watcher takes upstream's subscription-based settings watch, which acquires the subscription before forking so no settings write is missed, while keeping the fork's one-unlock secret priming from divergence 0016.
• The fork's shared epoch helper gives way to upstream's inline shape so the files-viewed epochs of divergence 0013 sit beside upstream's own, keeping the file free of a fork-only abstraction upstream will keep editing.
• The fork's files-viewed fold tests are rebased onto upstream's expand-by-default code tab, because that default was upstream's own choice and the fork's toggle helper is indifferent to it.
• Divergence 0024's administrator-merge field is re-added to the viewer-access stubs upstream introduced, and divergence 0024's bypass option is rethreaded through upstream's refactored action handler.
• The fork migration guard is repointed at the shared package after upstream moved the node:sqlite client there; the fork migration chain itself is untouched and upstream's own chain stays byte-identical.
• Glossary link references are renumbered because upstream claimed the numbers the fork's secret-resolver reference held.
• Upstream's deletion-cleanup fence and local-base-branch fallback landed in its own bootstrap path, which this fork serves from its own service, so both are ported across rather than lost to a file that never conflicted.

[cursor]

PR Summary

High Risk
Changes touch Electron upgrades, WSL backend launch and cache semantics, a new local activation protocol, and preview session partitioning—areas that affect security boundaries and packaged desktop reliability.

Overview
This PR brings in a large upstream sync centered on desktop behavior, plus smaller repo and workflow updates.

Desktop app activation adds a local control socket (Unix socket or Windows named pipe) so external commands can request open-workspace, focus the app, and wait on the renderer over new IPC/preload appActivation APIs. A broker queues requests until the renderer signals ready, with timeouts, cancel-on-disconnect, and focused tests.

Packaged Windows WSL backends prefer a shipped wsl-runtime.tar.gz keyed by a verified SHA-256 identity, stage into a distro-local cache, fall back to the mounted server tree when staging or node-pty fails, invalidate bad caches, and prune older runtime versions after HTTP readiness. Related lifecycle work destroys Electron windows synchronously on updater-driven quit so macOS relaunch does not race open windows.

In-app preview gains per-environment browser profiles (legacy default partition preserved, incognito non-persistent partitions, injective JSON partition scopes), profile-scoped cookie/cache clearing, CSP media-src and custom-scheme stream privileges, and stricter automation status schema wiring.

CI and packaging replace shell grep preload checks with verify-preload-bundle.mjs (parse + sandbox execute), bump Electron to 43.4.1, and set workflow contents: read. Docs and agent rules add testing discipline, Macroscope auto-approval guards for product defaults and lint suppressions, disabled CodeRabbit, more vouched contributors, mobile Metro reset troubleshooting, and removal of the root empty app.json.

^{Reviewed by Cursor Bugbot for commit 408ab86. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.2 KiB	−157 B (−1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.3 KiB	−159 B (−2.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	54.7 KiB	−910 B (−1.6%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.2 KiB	−133 B (−1.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.2 KiB	−134 B (−2.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	55.5 KiB	−884 B (−1.5%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: fcc1cbf · PR result: 408ab86 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.