TUI: panel checkmarks can diverge from workspace scope when a repo DB fails to open

[DanielCardonaRojas]

Context

Raised by CodeRabbit on #225.

RepoWorkspace::set_scope (crates/codemark-tui/src/browser/workspace.rs) tolerates repos whose database fails to open: it logs and excludes them, and if the entire requested scope is unopenable it keeps the previous scope unchanged (uncheck-last / never-empty invariant):

let has_survivor = self.dbs.iter().any(|(r, _)| checked.contains(r));
if !has_survivor && opened.is_empty() {
    return Ok(()); // keep previous scope
}

Meanwhile, in activate_context_selection (browser/events.rs) the panel active state is mutated before set_scope runs, and set_focus silently ignores a root that isn't in the workspace. So the panel's checkmarks (and the focused repo it implies) can diverge from the effective workspace scope:

• Enter (single-select): activate_selected_exclusive marks the chosen repo as the sole checkmark. If that repo's DB can't open, set_scope keeps the old scope, set_focus is ignored, and the Content panel keeps rendering the previous repo — even though the panel shows the new one as the only checked repo.
• Space (toggle): same class of mismatch pre-exists — toggling on an unopenable repo checks it in the panel while the workspace excludes it.

Proposal

Make set_scope report the effective accepted roots (the roots actually committed, including the retained previous scope when everything failed). Then in the event handler, reconcile the panel's active state and focus from that result before after_scope_change(), so checkmarks only ever reflect repos that are truly in scope, and focus is only set to a root present in the effective scope.

Severity

Edge case (requires a corrupt/missing repo DB), but produces a confusing selected-vs-displayed mismatch. Heavier lift because it changes the set_scope signature/contract and both activation paths.