fix(desktop): stop history search after enough matches

[liuxiaocs7]

Summary

Desktop history search currently waits for loadTranscript() to decode an entire conversation before checking any content. A 20,000-message transcript with a match in the oldest message still costs 20,000 decodes and 78 additional page requests even with limit=1.

Consume oldest-first message pages at the opening watermark and stop as soon as the global result or snippet budget is met. Reuse a complete small bootstrap, preserve source sequence identities, and close the search-owned handle on completion or cancellation. Preserve title priority, filtering and redaction, truncation at page boundaries, and rollback of a session's content hits on ordinary read failure. The existing Host protocol and shared page decoder are reused.

Fixes #5523
Refs #2913, #4677

Verification

The real IPC → matcher → subscription → Host pager/decoder regression in apps/desktop/src/main/__tests__/thread-search-pagination.test.ts failed before the fix (20000 !== 256) and now passes. It uses synthetic storage/transport; the counts below do not measure production wall-clock latency:

Same 20,000-message fixture	Before	After
Oldest message matches, limit 1: decoded messages	20,000	256
Oldest message matches, limit 1: requests after bootstrap	78	1

• Passed: 40 Desktop search/pagination/IPC tests and 6 UI search tests. Coverage includes page-end hits, cross-page budgets, sparse identities, fragmented messages, fixed watermarks, small/empty transcripts, cancellation, and failed-read/close rollback.
• Passed: npm run lint, npm run build, npm run typecheck, both Desktop/UI Knip checks, and commit hooks. Formatting passes for all Git-tracked files; the broad npm run format:check encounters 16 unrelated, pre-existing untracked investigation files in the local workspace.
• Full npm test completed but was not green. Shell PATH, executor cancellation and peer-invitation failures passed isolated reruns. Storage's child-readiness check passed with NODE_NO_WARNINGS=1; Eval passed on Python 3.12 (87 tests, 12 skipped) after the default Python 3.9 failed. Runtime Host's production Host publishes and retires an implementation child patch still fails in isolation with Hosted real-model Turn did not become terminal; that test does not exercise the modified search path. This PR does not claim a clean full-suite run.
• No Electron UI or real-network latency benchmark was run; request/decode counts in the regression test are the evidence for this change.

No-match and insufficient-match queries still require a full scan. Retaining the tail bootstrap before the forward scan makes the 20,000-message full-scan fixture use 79 extra requests instead of 78, about 16 KiB more raw data. The 256-message early-hit result is specific to the small-message fixture; completing a fragmented message may need continuation requests. Host-local search remains separate work under #2913.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex diagnosed and implemented the change, wrote regression tests, ran verification, and prepared/submitted this contribution on behalf of @liuxiaocs7. The commits contain Generated-by: Codex; retain it in the squash commit.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally (full-suite limitations are recorded above)

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No