Add configurable HISTORY project catalog

[woffko]

Summary

Adds a configurable project catalog to the HISTORY screen while preserving the existing session ownership and token accounting.

What changed

• Added PROJECTS modes: STRICT, DEEP, FULL, and CUSTOM.
• Added bounded Git repository discovery with worktree support and symlink protection.
• Added structured tool-call evidence indexing without parsing user prose or tool output.
• Grouped multiple checkouts by sanitized Git remote identity.
• Kept OWNER and RELATED sessions separate; related projects never receive duplicated usage.
• Added an incremental SQLite cache and background indexing with progress reporting.
• Added persistent project mode, DEEP depth, CUSTOM selections, and exclusions.
• Added keyboard and mouse navigation:
  • p switches project modes.
  • +/- and mouse controls change DEEP depth.
  • Space or mouse toggles projects in FULL for the CUSTOM list.
  • Double-click or Enter opens projects and sessions.
• Improved HISTORY header spacing and alignment.
• DEPTH is displayed only below the active DEEP mode.

Why

The strict owner-CWD resolver is correct for accounting, but sessions launched from a broad directory such as /home/user can hide the actual repositories involved.

The new catalog provides a separate discovery and navigation layer without changing project ownership or token totals.

Compatibility and safety

• STRICT remains the default and preserves previous behavior.
• RELATED links are navigation metadata only.
• Repository traversal does not follow directory symlinks or execute repository code or hooks.
• Large scans are bounded, cancellable, and performed in the background.
• Existing configuration and state files are migrated with defaults.
• The existing usage cache and token accounting remain unchanged.

Validation

• 144 tests passed.
• cargo clippy --all-targets -- -D warnings
• cargo fmt --check
• bash scripts/check-ascii.sh
• git diff --check
• Verified in a 180×45 terminal.
• Tested STRICT → DEEP → FULL switching, CUSTOM selection, progressive indexing, and scan cancellation.
• Validated against a local corpus of 220 sessions, including nested repositories and multiple checkouts.

An independent Gemini 3.1 Pro audit was performed, and its actionable performance and async-I/O findings were addressed before publishing.