feat(desktop): make Markdown file references in sessions openable

[nagarwal-godaddy]

Summary

Markdown file references in session transcripts (e.g. [Guide](docs/notes.md),
including percent-encoded space/CJK spellings) were rendered inert. They are now
actionable in Desktop: clicking stages a preview request and opens the workbar
generated-files tab, where the file is shown read-only through the existing
artifact text viewer — no second document viewer. The pane header offers two
explicit user actions: "Open locally" and "Reveal in folder" (main-process shell).
Every failure mode (missing/moved, outside-workspace, oversize, unavailable)
renders as an inline, non-destructive notice; the conversation stays mounted with
its scroll position.

Trust model (unchanged boundaries):

• @maka/ui only gains an additive file-ref destination kind carrying the raw
  reference text; it never resolves paths, and links stay inert wherever no
  dispatcher is installed (TUI/eval surfaces unchanged). file:// and all other
  schemes remain excluded from this path.
• Resolution + sandbox enforcement happen only in desktop main against the
  session's Runtime Host workspace root via @maka/runtime/path-containment
  (isPathInside over realpath'd root/canonical target): ../ traversal,
  out-of-root absolutes, and symlink escapes are rejected with typed errors;
  reads are Markdown-only and size-capped.
• Open/reveal go through injected main-process shell wrappers; the external-link
  guard and its closed allowlist are untouched.
• Remote hosts get typed workspace_unavailable failures.

Fixes #2664

Verification

• New main tests (workspace-file-refs-ipc-main.test.ts, 9 cases): inside-root
  reads incl. raw space/CJK + percent-encoded refs; ../ escape rejected;
  out-of-root absolute rejected; symlink escape rejected; missing → typed
  not_found; non-Markdown/scheme/control-char refs rejected; size cap;
  open/reveal resolve through the same boundary check and never reach the shell
  on refusal; remote-host and unknown-session failures.
• New @maka/ui tests: recognition of relative/absolute/percent-encoded/CJK
  refs; scheme rejection; actionable rendering only with a dispatcher installed;
  inert rendering without one and for file://.
• Gates run locally, all green from repo root: npm run lint,
  npm run format:check, npm run typecheck, npm --workspace @maka/ui test
  (234 pass), desktop main suite (1495 pass, incl. the workbar feature-boundary
  tests), npm run build, npx knip --workspace apps/desktop,
  npx knip --workspace packages/ui.
• Claim-check note: the issue had a verbal claim from 2026-08-17 with no PR; a
  status-check comment was posted before starting
  (feat(desktop): make Markdown file references in sessions openable #2664 (comment)) and the
  claimant had not replied nor opened a PR by the time this was filed.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: implemented end-to-end by "pi" (coding agent); commits carry
Generated-by: pi trailers.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[nitishagar]

Closing to re-create this PR from my personal account (nitishagar) with a corrected branch name — no code changes.

[Astro-Han]

I reviewed this head and found no blocking issues.

Makes transcript Markdown file references openable via additive file-ref kind, main-side realpath sandboxed open/reveal (1MB, md only, no file://), hosted fallback to non-destructive notice.

No P0-P3. Note: exact head currently has no hosted checks — needs CI green before merge.

简体中文

该头无阻断，待 CI。

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.