perf: make GUI cold startup single-flight and shared-cache invalidation coherent

[ozymandiashh]

Context

v0.9.20 substantially improved warm Desktop/Menubar fetches through resident codeburn serve processes, but a power-user corpus still exposes three residual cold-start/coherence problems on current main:

1. Electron and the macOS menubar start an artificial serve warmup, then immediately route the first real request through a separate one-shot CLI because the resident child is not marked warm yet. Electron's first overview also carries extraEnv, which always bypasses serve. This can parse the same large session cache twice concurrently per surface.
2. Serve's rendered-output memo is keyed only by argv. A same-argv request can return stale config-derived output for up to five minutes after config.json changes.
3. Cache-directory resolution is duplicated and has drifted: cursor-cache.ts and the Swift menubar status cache do not consistently honor CODEBURN_CACHE_DIR.

On a real ~117 MB session cache from a power-user installation, current-main one-shot status measured ~81 s cold and ~12 s warm, with ~1.7 GB max RSS. A resident child made an identical second request ~138 ms, but the first request for a different panel remained ~8.4 s. A behavior repro also showed currency=USD remaining stale after the config was changed to EUR until argv changed.

Proposed single PR

• Make the first real eligible GUI request the resident process's warmup, instead of launching an artificial query plus a fallback one-shot parse.
• Preserve Desktop cold-scan progress while the first request runs through the serve protocol.
• Invalidate serve output when config state changes and explicitly after Desktop mutations.
• Centralize the CodeBurn cache-directory contract and apply it consistently in TypeScript cache layers and the Swift status cache.
• Add behavior tests for a single cold execution, progress forwarding, immediate same-argv config freshness, action invalidation, and cache-dir overrides.
• Include before/after measurements on the large local corpus.

Acceptance criteria

• Exactly one heavy CLI execution for the first eligible Desktop request and for the first menubar refresh.
• No artificial warmup query racing the first real query.
• Same-argv serve output reflects config changes immediately.
• All CodeBurn-owned cache files resolve through the same default/override contract.
• Targeted root, Electron, and Swift tests pass; root build passes.
• Adversarial review is completed with Claude Opus 5 at max effort and DeepSeek Flash through local Hermes before the PR is opened.

Explicitly out of scope

• A shared cross-surface daemon/broker or SQLite/segmented cache migration.
• Refresh-lock semantics and cache-refresh-lock-process: takeover-window race misclassifies completed-by-other even in a serial single-fork run #904.
• Daily-history semantics and Session-cumulative providers (hermes) lose post-finalization usage from the daily history #916.
• Freshness-marker work in menubar payload: data-freshness marker for stale readOnly serves #771.
• The @codeburn/core extraction in Extract @codeburn/core: one engine, CLI as first customer (tracking) #809.

Those are separate architectural/correctness changes and should not be hidden inside this startup PR.

[ozymandiashh]

I’m taking this as one consolidated PR against main. I’ll keep the implementation to single-flight GUI startup, immediate serve/config invalidation, and a consistent cache-directory contract, with the large-corpus before/after evidence and both requested external adversarial reviews attached before opening the PR.

[ozymandiashh]

Implementation and validation are now in draft PR #972. It consolidates shared cache-path resolution, resident serve hydration, progress/invalidation, and Electron/macOS lifecycle hardening into one PR. CI is running; the PR will remain draft while checks and maintainer review complete.