fix: harden generation, workspace, and preview continuity

[hqhq1025]

Summary

• Settle cancellation before releasing generation/workspace ownership; cancel pending questions and queued publications, forward tool signals, and enforce the three-check repair ceiling with native pi lifecycle guards.
• Serialize participating workspace writers, preserve actionable source conflicts, respect inherited disabled controls, and retain encoded asset URLs in standalone/ZIP exports.
• Separate submitted context from new drafts, order chat snapshots at actual read dispatch, and prevent late file imports from answering a different question or session.
• Apply comments only when their immutable submitted content still matches. Preserve revised comments across completion/ACK races and persist pending/null state through JSONL reopen; the legacy explicit marking API stays compatible.
• Preserve tweak input focus through guarded autosaves and retain React component identity for render-time token reads. Computed/memoized compatibility cases update correctly with a localized, nonfatal state-reset notice.
• Serve the real tweak browser fixture from a temporary production build using public Vite build/preview APIs, removing dev-optimizer 504 races without retries, timeout increases, skipped cases, or product changes.

Validation

• Final normal pre-push lint, workspace typechecks, and all 10 package test tasks passed at f048ed5; desktop: 1,818 passed, 1 intentionally skipped.
• The final static tweak fixture and concurrent prompt fixture passed all 54 cases (36 + 18) locally. Linux/Node 22 CI 35263365774 passed lint, typechecks, tests, and the production bundle build. CodeQL and Dependency Review also passed.
• Production main/preload/renderer builds passed in isolated output; the running user application was not overwritten.
• Native pi tests cover actual editor writes, preview/done/revision orchestration, recovery, cancellation, queue boundaries, and repair limits. Browser executor substitution is explicitly distinguished from real browser tests.
• Actual system-Chrome and Electron checks cover local assets, forms, extracted HTML/JSX ZIP output, guarded saves, full text/hex editing, watcher settlement, and preserved counter/input/module/effect state. The final Electron product main-chain fixture passed 19 checks.
• Real Electron preload/host checks verified mixed comment-CAS results and pending/null persistence after a complete main-process restart, not merely a renderer reload.
• All three original independent reviewers cleared their assigned findings, including the second-pass question ownership, read ordering, edited-comment/CAS, and cached-hook variants. No remaining verified findings in that bounded review; no additional design-model submissions were made.

Compatibility checklist

• 🟢 Compatibility: preserve explicit unconditional replacements and legacy tweak refresh behavior; no claim of atomicity against uncooperative external writers or revocable in-flight OS writes. Compatibility replay may reset artifact state, with an explicit notice.
• 🟢 Upgradeability: additive versioned ask-cancellation and conditional comment-marking contracts, Changesets, and no new persistent-state migration.
• 🟢 Lean: no new shipped dependency or bundled model/browser runtime.
• 🟢 Elegance: reuse native pi execution boundaries, one canonical writer boundary, stable component identities, and bounded in-flight reconciliation rather than parallel execution/state systems.

The latest main changes from #424 are included without rewriting upstream history. Existing dependency alerts and unrelated generated-artifact quality limitations are outside this bounded fix set.

[hqhq1025]

Final required CI is green (35263365774), including Linux/Node 22 tests and production bundle build; CodeQL and Dependency Review passed. All three independent adversarial reviewers cleared their assigned original and second-pass repros. The additional ready-for-review DeepSeek workflow (35263880571) failed after three responses with empty final message content and posted no review; this is not being counted as a successful review. No check bypass or workflow change is being used. The repository only permits squash merges, so the validated candidate will be published using that normal merge mode.