fix(app): defer background workspace discovery

[opencode-agent]

Summary

Stop the app from eagerly discovering worktrees and MCP catalogs for historical projects that nobody has opened.

• Keep global project bootstrap metadata-only. Load worktree inventories for mounted sessions, opened workspace pickers, or workspace settings, with server-scoped caching, directory deduplication, cancellation of queued demand, and at most four concurrent inventory requests. Mounted-session inventory preserves workspace styling without suspending the session while discovery is pending.
• Invalidate only the affected project's inventory on worktree updates, and avoid preloading VCS information for every workspace.
• Preserve explicit or newly-created workspace selections even when cached inventory predates them, including retrying after session creation fails; never silently fall back to another destination.
• Defer event-driven MCP catalog reads for locations without a mounted app owner. Preserve cache invalidation for the next explicit read, coalesce same-batch MCP events, and keep questions, permissions, and session events flowing unchanged. Project settings retains its shared catalog while displayed.

The existing APIs are reused. All changes are confined to packages/app; no Core, Server, Protocol, or Client-package changes, new endpoints, or user-data migrations.

Why

Global bootstrap previously issued a worktree-list request for every historical project at once. Each request can initialize a Location and run discovery. Separately, MCP events caused catalog reads for unopened locations. Both paths can occupy the browser's connection pool, leaving health probes and interactive requests queued while an existing event stream continues receiving data.

Validation

• Regression tests exercise metadata-only bootstrap with 400 historical projects, duplicate directories, deferred picker demand, bounded discovery, cancellation, cache invalidation, and server isolation.
• MCP regression tests exercise 400 unopened locations, coalesced mounted-location updates, reopening, Windows path separators and workspace identity, default/project catalog owners, disposal, and unaffected permission/question events. Before the fix, the unopened-location case issued 800 MCP requests; afterward it issues none.
• bun run test:unit: 752 passed, 1 skipped, 0 failed.
• bun run test:browser: 117 passed, 0 failed.
• bun typecheck: passed.
• bun run typecheck:e2e: passed.
• bun --bun run build: passed (the Host's default Node 18 cannot run this Vite version; the build succeeds under Bun).
• Fixture-backed Linux Chromium production-build regression run on f41e968: 55 passed, zero retries across deferred discovery, workspace accents, MCP toggles, settings loading, branch selection, and pending/failed workspace creation. 300 historical projects produce zero new-draft startup inventory calls; opening the picker loads exactly one project; an existing session loads only its own project and stays editable while that inventory is deliberately stalled.
• The first full CI run caught a created-workspace retry regression caused by treating cached inventory as authoritative selection validation. That regression was reproduced locally against the production build and fixed by preserving explicit destinations; the original failing test now passes within the 55-test run.
• Full CI passed on f41e968: typecheck, Linux/Windows unit tests, and Linux/Windows E2E (including service-worker verification). Test run: https://github.com/anomalyco/opencode/actions/runs/33940334857
• Production session-entry benchmark around the scoped-session compatibility change (e06f774 → ca7ff99), three repetitions per scenario: median stable readiness was 229 → 246 ms for Home-to-draft, 270 → 131 ms for session-to-draft, and 785 → 717 ms for cold session entry. The baseline had one initial-navigation timeout before measurement (8/9 passed); the after run passed 9/9. These small, sequential shared-host samples do not establish statistically significant improvements or rule out smaller regressions.
• Manual packaged-Electron validation on the shared Windows development host remains unavailable because SSH is unreachable. Windows CI unit and browser E2E passed; that is not a claim of manually reproducing the user's packaged Desktop environment.

Requested by: @Hona (Hona via Slack)