fix: avoid repeated macOS privacy prompts

[nwparker]

Fixes #1522.

Summary

• Stop eager/global authorized-root rebuilds from startup, repo mutations, and worktree list refreshes.
• Seed filesystem auth roots from already-returned worktree list results, and avoid realpath() until a specific file operation needs canonicalization.
• Remove the right-sidebar branch-change fetchWorktrees poll by returning branch/head from git status --branch for local and SSH paths.
• Avoid background repo/worktree enumeration in terminal-history GC and optional Claude/Codex usage analytics.
• Keep SSH repos out of local filesystem authorization and usage attribution roots.
• Resolve the main merge’s oxlint 1.63 fallout by dropping the removed react/jsx-uses-vars rule and replacing one existing error-boundary componentDidUpdate reset with derived state.

Verification

• pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/worktrees-windows.test.ts src/main/ipc/repos-create.test.ts src/main/ipc/repos-sparse-presets.test.ts src/main/ipc/repos-remote.test.ts src/main/git/status.test.ts src/relay/git-handler.test.ts src/renderer/src/store/slices/worktrees.test.ts src/main/window/attach-main-window-services.test.ts src/main/window/history-gc-worktree-ids.test.ts src/main/terminal-history.test.ts src/main/usage-worktree-metadata.test.ts src/main/claude-usage/store.test.ts src/main/codex-usage/store.test.ts src/main/claude-usage/scanner.test.ts src/main/codex-usage/scanner.test.ts
• pnpm exec oxlint --format github
• pnpm exec oxlint <touched files>
• pnpm run tc:node
• pnpm run tc:web
• Final permission-dialog scan over worktree listing, renderer polling, and filesystem probe callsites.

[nwparker]

Reviewed locally. No blocking findings. I specifically re-checked the root cause path for #1522, the new seeded auth-root cache behavior, local-vs-SSH path boundaries, the branch/head status polling replacement, terminal-history GC, and optional usage analytics. Focused Vitest coverage, oxlint, tc:node, and tc:web all pass locally.