chore: sync with upstream pingdotgg/t3code main

[yordis]

• Upstream's own per-file "viewed" marking covers everything the fork carried for keeping your place in a review, so that divergence no longer exists and its ledger entry is deleted rather than adapted.
• Provider secrets in 1Password stay, and upstream's new usage lookup passes its configured values straight through: usage reads only locate provider home directories, so nothing on that path can resolve a secret reference or report one as unresolved.
• Upstream now owns GraphQL request budgeting end to end, so the fork's separate cost-estimate accounting is dropped instead of layered on top of it.
• Upstream already ships a generic capability error alongside the legacy preview-only one, so the fork's subagent-threads capability needs no widened error literal and that area is taken from upstream as written.
• Subagent threads no longer require agent browser access, because upstream always seeds the pull-requests capability now. Kept as upstream wrote it since it reads as a fix rather than a regression, but it deserves a maintainer's eye.
• The fork's migration isolation guard reads upstream's remaining public migration manifest, so the assertion that fork schema never leaks into the shared chain survives upstream narrowing what it exports.
• The fork's list patch is kept over upstream's narrower one, because only the fork's version restores the padding it borrows during a scroll adjustment, which is what keeps the timeline from scrolling past its content.
• Background work ordering moved off an API Hermes does not implement, since that state is reachable from mobile and upstream now lints for it.
• One timeline truncation helper the fork referenced was upstream's to begin with and upstream removed it, so that area takes upstream's simpler shape instead of keeping a fork-shaped call around a symbol nobody owns.

[cursor]

PR Summary

High Risk
Changes affect signed release/preview pipelines, secret-backed signing jobs, and release channel gating; mistakes could publish wrong artifacts or weaken fork-PR trust boundaries.

Overview
This sync brings upstream changes that reshape desktop release and macOS PR preview CI, tighten release sourcing, and update agent/mobile verification docs.

macOS desktop previews split into an untrusted PR workflow that only builds and uploads a js-bundle artifact, and a trusted workflow_run publish path on default-branch code that vouches the author, consumes the one-shot preview:mac label, validates the ZIP with stage-preview-bundle.py (path/size guards, no PR code on signing runners), then signs/notarizes via release-desktop.yml and publishes to the rolling desktop-preview release with cleanup on close/unlabel.

Stable/nightly/preview releases refactor release.yml to build the JS stack once (build_bundle), fan out per-platform jobs through the new reusable release-desktop.yml (including Linux arm64/Windows arm64 and per-arch CLI archives embedded for WSL), publish multi-package npm artifacts from those archives, and add a manual preview channel that omits updater metadata and skips AUR/web/Discord. Nightly/stable dispatches are rejected unless they run from the default branch and the commit is contained in it (assertReleaseSource / assertCommitOnDefaultBranch).

Mobile: EAS workflow gains a v2-preview store-build profile (no OTA); agent skills direct iOS/Android verification through scripts/mobile-native-client.ts ensure|check instead of treating a missing dev client as a blocker.

Smaller deltas: relay deploy passes FCM_SERVICE_ACCOUNT, CI tests the preview stager and formats/tests additional Rust crates, github:f-trycua on the vouch list, macroscope agents switch to incremental/neutral review, and the vendored .repos/alchemy-effect subtree picks up upstream workflow/tooling churn.

^{Reviewed by Cursor Bugbot for commit 9579d86. Bugbot is set up for automated code reviews on this repo. Configure here.}