feat(desktop): add host-bound folder references to the composer

[sunrioa]

Summary

Fixes #3994.

This PR separates the composer’s “Add files or directories” entry into “Add files” and “Reference folder”, with a native folder picker and removable folder-reference chips.

• Support up to four folder references per message, bound to the originating Runtime Host.
• Prepare a bounded, non-recursive directory listing when admitting a new message. File contents remain available through the existing filesystem tools on demand.
• Persist directory references and their prepared observations through send, reload, replay, and regeneration while preserving the user-authored message text.
• Keep the selected project, working directory, attachments, and sandbox permissions unchanged.

Before

After

Review focus

Directory selection adds a reference, not a recursive upload or a permission grant. Listing follows the existing filesystem boundary; inaccessible directories are reported as requiring access or unavailable, rather than silently treated as empty.

Preparation is limited to 100 entries per directory, a shared 8 KiB serialized-entry budget, and a five-second timeout. Timeout, cancellation, foreign-host references, and unsupported external execution are handled without turning expected preparation failures into a Runtime Host drain.

The implementation spans the Desktop picker/composer, message contracts, Runtime Host admission, runtime directory preparation, and persistence/rendering. After merging main at 3b9a4706b, Runtime Host compatibility advances from 61 to 62, so Desktop and Runtime Host must be updated together.

Supporting test changes close SQLite fixture stores before cleanup and handle platform-specific symlink and /proc/self/fd assumptions. Generated source/test inventories are updated; local verification notes and build artifacts are not included.

Verification

Unless noted otherwise, these results apply to head aa342d561304c7604ae7cb36751e86686901d863.

macOS

• Build, lint, format, typecheck, and Desktop/UI Knip checks passed.
• ASF header and generated inventory checks passed.
• Complete affected workspace suites passed: Core, Storage, Runtime, Runtime Host, UI, and Desktop — 8,014 passed, 38 skipped, no failures.
• Directory-reference Desktop E2E: 10/10 passed with --repeat-each=10, covering removal, send/reload persistence, bounded listing, and unchanged project selection.
• check:release passed, including 110 tests.
• Additional adjacent Desktop E2E checks: 12 passed and one failed; see the validation limitations below.

Windows — local verification

Environment: Node.js 25.2.1, npm 11.12.1, Cargo 1.98.0.

• npm ci and npm run build completed successfully.
• The Windows Broker compiled successfully.
• The real filesystem-worker Windows smoke suite ran six times. Every run reported four passes, zero failures, zero skips, and exit code 0.
• No EBUSY error or residual Broker/worker processes were observed.

Earlier full local Windows regression, packaging, and manual-acceptance records apply to f6f9c04fbdd73640038f178831cd7e52df3c5788. They are not counted as a complete local rerun on the current head.

GitHub Actions

• Main CI: passed.
• Windows release packaging and verification: passed.
• Windows recovery: passed.
• Dependency audit and Gitoxide helper admission: passed.
• Windows sandbox W0 evidence: failed during test teardown.

Validation limitations

Local adjacent E2E: deleting the session while a toggle is pending settles clean failed because the sidebar still contained one session row after the ten-second wait. The same assertion also failed on unmodified main at 3b9a4706b; two baseline runs produced one failure and one pass. This shows that the failure is not unique to this branch, but its root cause remains unidentified. The full local Desktop E2E matrix was not rerun after the merge.

Hosted Windows W0: all four smoke cases passed, but suite teardown failed with EBUSY while removing the temporary Programs\Maka\node.exe. The locking process has not been identified, and no successful hosted rerun has been recorded. The six successful local runs used a different toolchain from W0’s Node.js 24.19.0 / npm 11.17.0, so they do not establish that the hosted failure is resolved. A maintainer rerun of the failed W0 job is needed.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with source inspection, implementation, regression tests, local verification, code review, and drafting this PR. I have reviewed the changes and take responsibility for this contribution.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and the affected workspace suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No