Harden profile isolation and improve desktop reliability

[euforic]

Managed profiles could inherit another account's storage or launch routing, while switching profiles could leave the previous transcript visible. This pins browser and provider state to the selected profile, strengthens process attribution and recovery/lock ownership, rejects unsafe quota configuration, and clears stale chat state immediately.

The change also removes repeated filesystem resolution from warm conversation scans, prevents a broken provider pipe from terminating the application, and improves native light/dark surfaces, compact layouts, source identity, search, and error recovery. Existing named configuration profiles remain supported.

Validation:

• Full application suite: 307 tests, 12 opt-in skips, zero failures.
• Vendored renderer suite: 98 tests passed.
• Both installed-provider checks passed with two temporary profiles, restart persistence, and preservation of all pre-existing instances. Open-file inspection also confirmed the selected storage roots and no default/sibling storage access for the affected provider.
• Eight synthetic native-window captures passed in light/dark and regular/compact layouts.
• Privacy audit, app build, package validation, and diff whitespace checks passed.

Existing account files were not manually modified or migrated, and the installed application was not replaced or restarted. Application-state separation does not replace operating-system isolation. Detailed findings and evidence are in docs/audit-2026-09-07.md.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.