fix(bookmarks): publish an initial state and decode host intents so the OOP panel can render (#7)

[abhinavtbuilds]

What this fixes

Fixes #7, taking the issue's second option. The first, a BookmarkDataProvider IPC proxy plus a bookmark.proto contract, needs new BossConsole wire surface and a host service. This makes the out-of-process bookmarks holder render and be host-drivable using only what the runtime already has.

Two things kept the panel empty forever:

1. BookmarksStateHolder never published. Neither constructor called updateState, so the holder stayed at version 0 and the host's strictly-newer applyState guard dropped every envelope. AGENTS.md and five other holders' comments call this "the bookmarks failure mode"; every other holder was fixed except this one.
2. It had no arm in resolveIntentDeserializer, so every intent the host sent was dropped, including the CollectionsUpdated / FavoritesUpdated data updates that are the only way to populate it without a provider.

What I changed

• Initial publish. The (scope) constructor publishes updateState { copy(ready = true) }, and the (scope, context) constructor delegates to it, the same shape as FlowStateHolder.

• Honest capability flags. BookmarksState gains ready (distinguishes "initialised, nothing synced yet" from "no state ever arrived") and persistenceAvailable = false (create, rename and delete change only this child's copy). Both are on the wire via StateWireJson, so a renderer can tell "unavailable" from "not sent", as with Flow's flags.

• decodeBookmarksIntent next to the intent type, plus its arm in resolveIntentDeserializer. Payloads follow the other decoders:

  • one id or name as the raw string: ToggleCollectionExpanded, DeleteCollection, CreateCollection, RemoveFavoriteWorkspace;
  • several fields as a JSON object keyed by property name: OpenBookmark / RemoveBookmark (collectionId, bookmarkId), RenameCollection (collectionId, newName), AddFavoriteWorkspace (id, name);
  • CollectionsUpdated / FavoritesUpdated as a JSON array in the same shape as state.collections / state.favoriteWorkspaces on the wire, so a host can send back exactly what it reads.

  Malformed, blank or incomplete payloads are dropped, and a JSON object is never read as a bare id ({} does not become a collection named {}). A data update that fails to decode is dropped whole rather than applied in part.

• The constructor warning now says what a host has to do (push CollectionsUpdated / FavoritesUpdated) instead of only that sync is off.

Tests

• BookmarksStateHolderTest (new, 8): publishes a versioned empty state on construction; persistenceAvailable=false and ready=true survive the wire encoder; a host populates collections and favorites through the decoder; the data-update payload round-trips from the state's own wire shape; malformed updates are dropped; every intent's payload shape; blank or missing fields, {} as an id, and unknown intents are dropped.
• IntentDeserializerArmsTest (+1): routes bookmarks intents, so deleting the arm fails a test, as that file intends.
• Mutation-checked: removing the constructor's updateState fails two tests, and removing the arm fails the arms test.

./gradlew build passes locally (265 tests; 256 before).

Two notes

• CI will likely fail to fetch its dependencies, unrelated to this change. downloadDeps pulls from BossConsole-Releases latest, which is now v9.5.21 and ships boss-ipc-1.2.0.jar, while ipc.version here is still 1.0.0, so the download 404s. I verified with -Pupstream.source=https://github.com/risa-labs-inc/BossConsole-Releases/releases/download/v9.5.19, the last release with the 1.0.0 jars. fix(runtime): keep state versions consistent and emit versioned state deltas #23 edits gradle.properties and the build workflow and may already address this.
• BossConsoleRust's regression guard will flip. The issue mentions real_bookmarks_plugin_runs_but_its_state_stays_empty_upstream_gap, which asserts the child publishes no versioned state; after this it publishes one. That is the signal the issue describes for enabling the panel host-side.

Applies cleanly on top of the open #22 and #23.