Release v1.3.231

23 commits since v1.3.230. One feature (blind-spot error handling), 14 fixes,
8 companion test commits. All fixes carry regression tests.

Feature: Blind-Spot Error Handling

339c375: unrecognized provider errors no longer render as the hollow
"请求失败，请稍后重试" (request failed, try again later). The fallback
message now appends the raw cause (truncated to 400 chars), and
debug.EnsureFileLogging() turns on file logging at runtime the first
time a blind-spot error is seen — the UI shows the log path so users can
attach real diagnostics. Blind-spot errors auto-retry up to 5 times at
5-second intervals with a visible countdown; the retry budget resets on
success, and guards prevent takeovers while queued input is present or
the user has already sent a new message in the window.

#1393 (8c8decf0): an aborted submit no longer loses captured
screenshots — the composer restore keeps the queued images; a failed
@mention expansion no longer eats attachments. Pinned by 40b7c58b.
#1411 (0e8a3a7d): Esc-cancel restore keeps queued images;
@completion refuses path traversal. Pinned by 5b06a0e6.
#1410 (eff11ea0): API key masking counts runes consistently — no
more negative strings.Repeat panic on short keys.
#1409 (f7f8a7b3): resetConversationView clears session-scoped
todo state, so stale todo cards don't survive a reset.
#1417 (69347cc5): concurrent IM ensure waiters now observe the
starter's real result instead of a stale success/failure.
#1414 (6f764d4e): shell-correct apostrophe escaping; OSC escape
sequences stripped from extpane output.

#1415 (725c5d32): ja catalog regains lost format verbs; a CI guard
now keeps i18n format verbs consistent with call sites across all
languages.
#1416 (6992753f): pt /model regains the available-models list;
Signal QR fetch shows an in-flight state instead of silence.

#1421 (5f2d3e8c): Keychain-degraded migration no longer deletes
the only copy of stored credentials — the delete-then-write sequence is
now copy-first, so a failed write can't destroy the last good value.
#1413 (ef910c68): a key exchange failure no longer parks
sendEncrypted forever; the wait is unblocked on error paths.
#1404 (d7a4ecc6): Matrix E2EE device identity persists across
reconnects; store paths sanitized and identity-isolated. Pinned by
b05da932.

#1408 (27d78fa2): file tracker resolves symlinks — alias pairs
(same file reached via two paths) share one tracking key.
#1406 (26faf98a): ExitWorktree fails closed on unknown action
instead of silently succeeding; domain exemption matching normalized.
Pinned by e762bf51.
#1407 (49450106): jj status counts per-file; svn IsClean ignores
externals so unmodified working copies report clean.

#1420 (27f8a5e7): tray setup holds trayMu through init — the
shutdown race no longer orphans the tray tmpdir.
#1412 (adc630bf): WebUI vendor PUT keeps the display name when the
API key changes; omitting max_iterations no longer writes 0.
#1402 (30b99541): updater RunHelper rolls back earlier targets
when a later target fails, instead of leaving a half-updated install.

#1405 (37113598): PAC fetch failure gets a negative cache (no
retry storm); SafeSymlink stops truncating on EEXIST.