fix(startup): restore saved sessions promptly and stop plugin heartbeat reloads

[pascalandr]

Summary

Restore the saved project/conversation promptly, preserve restored tabs when later hydration fails, and remove a filesystem heartbeat that repeatedly invalidated OpenCode configuration.

Root cause and reproduction

PR #666 placed desktop plugin presence leases beneath the authenticated OpenCode configuration discovery root. Updating their mtimes every two seconds triggers recursive configuration watchers and expensive revalidation across loaded locations.

With CodeNomad closed and the same shared OpenCode daemon left running, updating only a temporary file in that directory reproduced the slowdown:

• Quiet: 77–92 ms for the same 200-message request.
• File mtime updated every two seconds: 5.3–8.8 seconds.
• Updates stopped: 71–138 ms.

The pre-#666 server/UI comparison was only a partial baseline: native reads recovered after startup, but the older UI also exhibited restoration failures.

Implementation

• Derive a sibling plugin storage namespace from the connected daemon's authoritative discovery root. Move new heartbeats outside its recursively watched configuration tree.
• Migrate existing managed inside-root storage while retaining read-only observation of older backends' leases. Preserve existing outside-root storage, independent backend lifetimes, and native WSL path translation.
• Seed saved selection identity before HTTP hydration, prioritize the saved project, and hydrate its conversation directly. Preserve bound project tabs across subsequent hydration errors/timeouts and respect user selection changes.
• Load model/agent catalogues when the client becomes ready and retry reads superseded by the initial stream connection.
• Publish session lists without waiting for runtime-status reads; merge delayed status results without overwriting SSE updates or local admissions. Use lightweight status reconciliation for liveness.
• Bound secondary reads across projects, coalesce Shell refreshes, and prevent duplicate catalogue/Shell refreshes through the native transcript projection.
• Preserve directory authorization while avoiding Git mutation-identity resolution on reads; reject unrelated Git common directories before native worktree inventory scans.

Validation

• Targeted UI and server suites covering reconnect races, status authority, background queue cancellation, projection isolation, Shell refresh coalescing, and ownership enforcement.
• 19 plugin path/lifecycle/migration/presence tests passed.
• Six browser restoration scenarios covering Electron/Tauri, saved selection, user selection, and hydration timeout behavior passed.
• Isolated OpenCode 2.0.9 integration fixture passed: native provisioning, plugin availability, independent leases, shutdown/reopening, and OS watcher verification that heartbeats do not modify the configuration tree. A negative control using the old storage placement fails that assertion.
• Typechecks, complete server/UI/plugin build, and git diff --check passed.
• Installed usual-profile Tauri validation on the requested conversation: launch-to-display 3.86 and 5.33 seconds; initial 200-message requests 178–239 ms; latest forced reload 218 ms. No intermediate wrong conversation selection observed. Verified all three saved projects and the real model menu.

Remaining observed edge case

A forced reload racing restoration of an old scroll position can still show the existing history retry control. Retrying succeeded. This PR addresses the reproduced latency trigger and startup restoration races; it does not claim that every scroll-restoration edge case is resolved.