feat: add secure file and source control workflows

[klioen]

Summary

Turn Files into a security-bounded project file manager and complete the core Source Control workflow without changing SpireCode's Project → Worktree product model. The change also aligns Projects menus, dialogs, and branch options with the Files surface language.

Related work

• Issue: None
• Accepted intent/spec/plan:
  • docs/files-crud/
  • docs/project-files-surface-alignment/
  • docs/orca-aligned-source-control/

Changes

• Add narrow Main-owned file create, rename, move, copy, Trash, and reveal operations with canonical containment, .git exclusion, symlink protection, and per-worktree serialization.
• Add Files context menus, inline rename, duplicate/cut/copy/paste, dirty-file deletion warnings, editor path migration, and watcher-driven refresh.
• Align Projects menus, worktree dialogs, and branch options with the shared Files popover/dialog surfaces while preserving their existing semantics.
• Upgrade Changes with filtering, collapsible conflict/staged/unstaged/untracked groups, status/rename/numstat details, row and group actions, destructive confirmation, and staged-only commit with Cmd/Ctrl+Enter.
• Add narrow git_stage, git_unstage, git_discard, and git_commit IPC. Harden Git execution against inherited repository/index redirects, hooks, external diff/text conversion, selected executable filters, unsafe paths, and overlapping filesystem mutations.
• Coordinate discard with in-flight editor saves, dirty buffers, resource caches, open tabs, and diff refreshes.
• Add English and Simplified Chinese copy, SDLC artifacts, regression tests, and changelog entries.

Risk and boundaries

• Regression risk: Medium-high. This touches filesystem CRUD, Git mutation, editor resource identity, watcher refresh, and several visible workbench surfaces. The implementation is covered by Main, IPC, store, projection, editor-coordination, interaction, and security regression tests.
• Security/privacy impact: Renderer authority remains limited to typed worktreeId + relativePath requests. Main validates canonical roots and paths, rejects traversal/absolute/NUL/.git/symlink escapes, uses Git argument arrays, serializes mutations, and never falls back from system Trash to permanent deletion. Repositories selecting executable Git filters fail closed.
• Data or configuration migration: None.
• Platform/package impact: Electron Main behavior changes on all desktop targets. A macOS arm64 App/DMG was bundled and smoke-tested locally; Windows and Linux packaging remain CI/target-host verification responsibilities.
• Rollback approach: Revert this commit. No persistent schema or dependency migration is introduced.

Verification

pnpm check
# 68 test files, 450 tests passed; release tests passed

pnpm build
# Renderer and Electron Main builds passed

git diff --check origin/main...HEAD
# passed

pnpm bundle
# macOS arm64 App signature, packaged-app smoke, and DMG smoke passed

• Tests cover new or changed behavior.
• pnpm check passes locally.
• I ran pnpm bundle on each affected native target. macOS arm64 passed locally; Windows and Linux require target-host CI.
• UI screenshots are not attached; all UI changes are covered by interaction and style-contract tests.

Contributor checklist

• I read CONTRIBUTING.md and the repository AGENTS.md.
• The change follows accepted spec/plan artifacts.
• Renderer/Main authority, relative-path validation, Git argument arrays, and credential boundaries remain intact.
• Public docs and CHANGELOG.md are updated for user-visible changes.
• The diff contains no credentials, private data, unrelated generated files, or accidental dependency updates.
• I reviewed the diff for correctness, security/privacy, and compliance with accepted scope.