Refactor desktop runtime, project persistence and model/tool execution

[zerobudian]

Problem and behavior

The desktop did not start its Sidecar, HTTP bodies could be truncated, and shared streaming state let requests interfere. Project controls and attachment handling were placeholders, while model retries, tool parsing and resource ownership could duplicate work or leave background processes running.

This change establishes one runnable root application and authenticated, owned Sidecar lifecycle; separates HTTP/runtime/project/provider services; isolates chat runs and confirmation/cancellation; and preserves native tool calls, usage, history and partial output. Todo/Pin, file previews, actual text/image uploads and provider management now persist through their APIs. Context budgeting preserves complete tool exchanges and full disk history.

The engine uses explicit imports and instance-owned background state. Tool dispatch has a registry and 109 native schemas; bounded JSON parsing replaces fragile regular expressions. Atomic project/history writes, exact task matching, symlink/path checks, reviewer restrictions, hook failure handling, detached memory snapshots and terminal cleanup correct data-loss and execution failures. MCP sessions now enter/exit in the same owning task, LSP transport reads complete frames promptly, and the legacy Qt interface initializes its reasoning animation correctly.

Validation

• 66 Python regressions and 11 JavaScript tests passed locally.
• Real Sidecar → ChatEngine → OpenAI SDK integration with a local provider, including native file creation/results, usage, text/image attachments, models/balance and history.
• Real local MCP handshake/list/call/restart, LSP initialize/exit, persistent shell exit/timeout and snapshot/file round trips.
• 109 registered tool/schema contracts, 200 seeded text-tool JSON variants, parser/validator and keyword indexing.
• Native Electron/Playwright smoke: IPC/auth, projects, persisted Todo/Pin, tools, previews, attachments, context settings, Markdown, restored history, zero page errors, owned process cleanup.
• Qt offscreen smoke imports all 158 engine modules and exercises the main window and message/task/file widgets.
• Ruff, Python compile/3.10 grammar, JS/Bash syntax, dependency consistency and diff whitespace checks.
• CI installs locked core/optional/dev dependencies and publishes coverage plus desktop screenshots. Python line coverage is approximately 32% across Sidecar/engine excluding GUI; this does not claim complete tool/business coverage.

Scope and limits

See docs/DELIVERY.md for the source baseline, reproduced defects, module evidence and remaining work. Real provider credentials, Windows/macOS native runs, installers/signing/updates, neural embeddings and every third-party server/tool/subagent scenario were not available for validation. Desktop attachments support UTF-8 text and PNG/JPEG/GIF/WebP; binary documents are explicitly rejected. Context estimation is heuristic and does not guarantee 1M provider support. Current system tools did not expose historical analysis memory, so historical conclusions are not assumed to be recovered.