fix: twenty-two low-severity findings from the v0.42.0 audit

[omartelo]

The LOW-severity half of the code-quality audit of everything since v0.42.0 — 22 findings, all
fixed, none skipped. The HIGH/MEDIUM half is fix/audit-high-medium; that PR merges first and
this branch expects a rebase over it (both touch worktree.go, FileDiff.tsx, use-panes.ts,
panes.ts, SessionSidebar.tsx).

Backend

• Hands-on time survives a store error: a failed AddHandsOn write requeues the drained
  seconds instead of logging them away, keeping the documented at-most-one-flush loss bound.
• A crashed shell env dump names its error: the PTY reader's read/Wait failure reaches the
  "yielded nothing" warn instead of err=nil.
• A directory at an oid is refused: git show <oid>:<dir> exits 0 with a tree listing, which
  FileLines returned as file lines; the git-object path now rejects trees, and the oversize and
  binary refusals are tested through it rather than only through the working tree.
• A preview error names the relative path again, not the absolute one relpath.Resolve
  stats.
• Test gaps closed: a Codex fixture with nonzero cache-write tokens, a locked reason on the
  fallback window pair, and checkedText's bad paths via git/gh.
• Deduplication: the ..-escape predicate lives once in relpath; the no-prompt env block
  is shared between project and themes; HandsOn/handsOnOf collapse onto one
  QueryRow implementation.
• The theme clone hides its console on Windows (winexec.Hide), the same seam every other
  child process already goes through.

Frontend

• A note typed but not entered is no longer dropped by Send, and the draft clears with the
  batch instead of resurfacing later.
• The comment composer keeps its anchor when a gap above it is expanded.
• A cancelled close dialog's late "adopted" probe no longer lands on the next dialog
  (staleness guard), so the destructive button cannot show for the wrong checkout.
• The footer's hands-on readout resets on session switch (resetOn), instead of captioning
  the previous session's time as the new one's.
• Both new drags handle pointercancel, so an interrupted drag cannot leave a buttonless
  hover resizing tracks.
• groupWith now enforces the same fits guard add does, counting what did not fit as
  skipped — the toast already reports it.
• Cleanups: dead exports un-exported (MIN_PANE_HEIGHT, grouped), delegatesOf computed
  once per card, the pane-grid 0.01 tolerance and the footer's "15 minutes" ↔
  handsOnIdleGap mirror both commented, PaneHeader extracted out of TerminalHost's
  five-deep JSX, and the move-dialog state extracted from SessionSidebar.

Test plan

• New tests: hands-on requeue on write failure, shellenv error propagation, tree/oversize/
  binary refusals through the git-object path, Codex cache-write pricing, locked reason on the
  fallback pair, plus the frontend guards where extractable pure.
• Full local gate: gofmt, go vet, Go tests, pnpm check, 1,320 frontend tests,
  production build, and the linux/darwin/windows build+vet loop (this touches an OS seam).
• Rebase over fix/audit-high-medium once it lands.