feat(web): add workspace change review

[627150795]

Problem

The Web UI does not expose the current Session workspace's Git changes, so users cannot review modified, deleted, untracked, or binary files from the active workspace. Closes #536.

Value

Users can understand workspace state and inspect bounded file-level diffs without leaving the Web UI. The view is read-only and scoped to the active Session.

Approach

• Add a Session-bound GET /api/workspace-changes endpoint that discovers the repository, compares against the current HEAD (or the empty tree when there is no HEAD), and computes bounded per-file diffs.
• Report explicit clean, non-repository, unavailable, binary, truncated, and untracked states.
• Add a Web UI view with refresh, file status/stat summaries, and selected-file diff details.
• Bound file count and diff sizes, and abort Git reads when the request is no longer active.
• Rebased the feature commit onto upstream main at f6b49ae59605b1276b8267f2886d22c03f01533c; final candidate SHA is a64702220cda33bf0267d002fe4f08c3d6f38953.

Validation

• node --test --experimental-strip-types tests/web/workspace-changes.test.ts — 2 passed.
• node --test --experimental-strip-types --test-name-pattern="Session-bound workspace changes" tests/web/web-host.test.ts — 1 passed.
• bunx vitest run tests/web/app-render.spec.ts tests/web/web-store.spec.ts tests/web/web-protocol.spec.ts — 159 passed.
• bun run check — passed: contracts, UI/root type checks, format, lint, and production Web build.
• bun run test:web:e2e — 33 passed, 1 failed in the pre-existing delayed workspace-creation receipt test; the target unknown-admission test passed at the final SHA. The original CI failure (Response has been disposed in that target test) was reproduced from the recorded CI log, but not locally; the same target test passed 30 times on the PR head and 10 times on its parent.
• bun run test — 1,564 tests reported, 1,554 passed, 0 test-level failures, 10 skipped; the runner also reported the unrelated optional background-terminal deadline process-tree failure. The full suite is therefore not a clean green gate.

Impact

• User-visible behavior: adds a read-only Workspace Changes view.
• Model-visible context/tools: None.
• Runtime/lifecycle: adds bounded Git reads for the active Web Session; no write, stage, or commit operations.
• Persisted config/data: None.
• Compatibility or risk: non-Git workspaces and Git errors are reported explicitly; diff/file output is bounded. No functional code change was made for the unrelated CI E2E failure because the affected test predates this PR and is unchanged by its diff.

[tt-a1i]

审查提交：a64702220cda33bf0267d002fe4f08c3d6f38953。

需要修改后再合并。

具体问题

P2 — 重命名只比较新路径，展示为整文件新增 · web/host/workspace-changes.ts:212

Exact-head real-Git repro git mv old.txt new.txt without content edits returns status renamed but additions=2/deletions=0 and /dev/null new-file diff. previousPath is parsed but omitted from diff and numstat pathspecs.

P2 — 只读改动查看会执行 textconv 命令 · web/host/workspace-changes.ts:207

Exact-head real-Git repro configures diff.audit.textconv='sh .git/textconv.sh' and *.txt diff=audit; loadWorkspaceChanges executes it and writes .git/audit-marker. --no-ext-diff does not disable textconv. Route validates session/workspace identity but has no trust/execution admission check.

验证范围

Full production/test diff reviewed; 41 Node tests and 45 UI tests pass. Independent real-Git rename and textconv reproduction saved in repro.mts/repro.log.

限制与后续

No browser layout acceptance. Textconv repro uses explicit local Git config, not a claim that a fresh clone can inject config. Baseline HEAD can move during sequential per-file reads; not independently reproduced.