perf(runtime): bound caches, scans, and background work

[beruro]

Problem

Repository, project, sidebar, benchmark, file-index, webview, git-watcher, Kanban impact, and Git History paths could duplicate in-flight work, retain unbounded cache/surface state, miss authoritative invalidation, or continue hidden/background work beyond the owning lifecycle.

Solution

• Coordinate equivalent reads with retryable single-flight ownership and fence late results by scope.
• Bound project/file-index caches, retained browser surfaces, Git watchers, Kanban summaries, and automatic Git History filter expansion.
• Suspend hidden webview/layout work and throttle/coalesce deleted-work-item purges.
• Keep sidebar coordinators owned per Jotai store so multiple windows do not share mutable lifecycle state.
• Keep this PR stacked directly on refactor(async): add scoped resource lifecycle #562 and independent from sibling refactor(data): scope async resource consumers #563.

Potential risks

• Cache invalidation, failed-owner retry, scope identity, and repeated open/close behavior remain the highest-risk paths.
• Protected or busy repositories can temporarily keep the watcher count above 20 until a later registration finds an idle eviction candidate.
• Kanban still receives the full orgtrack RPC payload transiently before projecting it to the visible roster.
• Git History automatically searches only the newest 500 commits; older matches require explicit user action.
• This PR depends on refactor(async): add scoped resource lifecycle #562 and should be retargeted only after refactor(async): add scoped resource lifecycle #562 lands. Rollback is a normal revert; there is no schema, wire, or persistence migration.

Performance audit

Verdict: pass with documented safety valves. Active operations keep one owner per scope/store, equal requests coalesce, late generations cannot publish, retained caches/surfaces have explicit caps, and hidden work suspends.

Verification

Validated locally after merging current #562 head 8618af370 into head 98e9304de without conflicts:

• pnpm install --frozen-lockfile — PASS. The optional legacy node-sass native postinstall warning did not block installation or checks.
• Focused Vitest across all 13 changed test files — PASS, 13 files / 81 tests.
• pnpm typecheck — PASS.
• cargo test -p git watch::tests::watcher_tests -- --nocapture — PASS, 17 tests.
• git diff --cached --check before the merge commit — PASS.

Because this stacked PR targets junyu/async-resource-lifecycle, full frontend/Rust CI may not run until #562 lands and this PR is retargeted to develop.

UI evidence

The Git History capped state uses the existing placeholder action composition. No new visual change was introduced by this base merge; focused state-transition tests cover when the action appears.