feat(chat): ordinary authorized workspace conversations without implicit Goals

[huangruiteng]

Chat currently requires a Goal or the global manager, so an ordinary workspace question inherits a role it did not select. This change adds a host-authorized, read-only project context and a secondary Settings → Project conversation entry point. Two messages and a process restart retain the same Core Session and native thread without creating a Goal or collecting portfolio context.

The existing typed conversation owner resolves the workspace reference and grant; Python observes configured roots and performs IO. Sessions persist the exact context. Unknown, missing, or retargeted roots, Goal-bearing project requests, LoopX execution, and external audiences fail closed. The UI supports open/resume, new/close, canonical history, durable admission readback, and exact stop; an admission failure retains the draft and request identity.

This is an independently usable local workspace slice from current main. Lark project audience binding, timely later-input admission, authorized Agent selection, live Lark/model qualification and mobile Bot journeys remain open in the existing RFC. This PR does not include or depend on the unmerged transport scheduling changes in #5538 and does not qualify a deployment.

Validation:

• 115 relevant Python tests passed; the final malformed-input update was rechecked with all 3 ordinary-project tests passing.
• Focused typed-owner tests, control-plane and dashboard type checks, packaged Chat build, CSS token check, Ruff/Mypy configured checks, semantic inventory/drift checks, CLI output-budget regression, and risk-selected premerge canary passed.
• Full TypeScript suite: 3998 passed / 3999 total. The Mac Python-discovery test a worktree venv wins over an unusable system python3 fails because the fixture resolves Homebrew Python; reproduced on unchanged local checkout 1e9e82b03 (not the exact PR baseline 99839aeb8). The resolver and test are unchanged in this PR.
• Actual packaged browser with the real owning backend and synthetic native protocol fixture: continuous messages, reload/resume, exact stop, 390px viewport, workspace revocation rejection with preserved draft, and retry after restoration passed. This proves the product/Core journey, not real model or Lark transport behavior.
• A separate real installed Codex host canary on this source head passed: two synthetic messages retained context in one native thread; a fresh controller resumed the same Core Session/native thread and retained the earlier code. No Goal file was created. This qualifies local native model continuity only; live Lark and mobile remain untested.
• Runtime/authority changes require maintainer review and merge; no self-merge.

Public-safe synthetic visual evidence:

Current exact-head qualification (1e0bedc160a5db421741cf26ff6cc8830e8fd51c):

• Moved the project context IO companion into the native Chat capability package; the top-level module budget remains 147. The ordinary-project tests (3) and module/census/maintainability checks (27) passed after this fix.
• CI is not green: all four Python shards and the merge gate fail. Five selected fingerprint/source-grant failures were reproduced unchanged on the exact baseline 99839aeb8; this attribution does not cover every CI failure.
• Release Artifacts build also failed while waiting for “需要宿主确认” in the existing typed-actions browser scenario. The Python workflow's Chat bundle browser and dashboard acceptance checks passed. The separate release-browser failure remains an installation hold; it was not waived or declared fixed.
• Native owner-only Lark project admission is a separate stacked successor, not part of this local-workspace diff. Runtime/authority changes remain for maintainer review and merge.