feat(reliability): consolidate CI and storage safeguards

[luoye520ww]

Problem

Packaging failures were hard to classify and the repository had multiple split storage branches that were difficult to review. The packaged smoke job also waited indefinitely for an extension guest target even when the packaged page was already running normally.

Root cause

The smoke helper had no bounded fallback when Chromium did not expose the guest target in time. Storage lifecycle behavior was split across separate PRs without a single reviewable contract.

Scope

This PR consolidates two repository reliability concerns into one maintenance change: CI/package diagnostics and bounded storage lifecycle safeguards. It does not change product runtime behavior, automatically delete user data, or add UI.

Changes

• Add packaging failure classification, local reproduction commands, path-based native smoke gating, and a time-bounded flaky registry.
• Make packaged extension smoke polling bounded and use one guarded DOM click fallback when the guest target is not exposed.
• Add bounded per-category storage usage scanning with missing-root and error reporting.
• Refuse to follow symlink/junction roots or child entries.
• Add pure cleanup decisions protecting active threads, unmerged worktrees, pinned checkpoints, and recent rescue snapshots.
• Add validated retention categories and fail-closed age checks.

Safety

• Storage scanner is read-only and has a per-category entry budget.
• lstat is used before opening roots and child entries.
• Invalid timestamps and retention policies retain data rather than deleting it.
• Cleanup policy returns a decision only; deletion services must re-check paths and races.
• Smoke fallback is single-shot, bounded, and only targets the same visible non-disabled control.

Tests

Local validation on the consolidated branch:

npm.cmd exec vitest run scripts/ci-reproduce.test.cjs scripts/flaky-test-registry.test.cjs scripts/native-smoke-path-gate.test.cjs scripts/packaging-failure-classifier.test.cjs scripts/smoke-packaged-extension-desktop.test.cjs src/main/services/storage-usage-report.test.ts src/main/services/storage-cleanup-policy.test.ts src/shared/data-retention.test.ts
npm.cmd run typecheck
npm.cmd --prefix kun run typecheck
npm.cmd run lint
npm.cmd run build
npm.cmd rebuild better-sqlite3
npm.cmd --prefix kun test -- tests/thread-store-diagnostics.test.ts tests/thread-store-doctor.test.ts

Results:

• CI helper and storage targeted tests passed (40 script tests plus 16 storage tests).
• Thread-store diagnostics tests passed (9 tests) after rebuilding the native SQLite binding.
• Root and Kun Typecheck, lint, build, and diff check passed.
• Packaged smoke validation passed on Linux and Windows on the previous CI run; macOS guest-target fallback is covered by the updated smoke helper and is being re-run on this consolidated head.

Review performed

• Functional correctness
• Concurrency/lifecycle and bounded traversal
• Data integrity and fail-closed retention
• Symlink/path safety
• Cross-platform packaging behavior
• Performance bounds
• Test quality and PR scope

PR size

• Production files: 11
• Test files: 6
• Total changed lines: 1,247
• One commit from latest develop

Non-goals

Automatic cleanup, retention UI, backup integration, database repair, and full release-channel orchestration remain separate follow-ups.

Supersedes

• ci: classify native packaging failures #907
• ci: gate native smoke by changed paths #908
• ci: add local packaging reproduction entrypoint #909
• test(ci): add expiring flaky test registry #914
• fix(ci): click visible packaged extension contribution #915
• feat(storage): add bounded storage usage report #917
• feat(storage): define safe cleanup policy #918
• feat(storage): define data retention contract #928

[luoye520ww]

All required checks are green (Typecheck/test, Linux, macOS, Windows). The next consolidated IPC/SSE reliability PR is intentionally waiting on this PR so it can target develop without duplicating the packaging/storage diff. Please merge #941 before the dependent branch is retargeted.

[luoye520ww]

Closing this split PR to reduce review fragmentation. The branch and commits are preserved; this work will be reintroduced in a smaller consolidated PR after the current reliability baseline is merged.

[luoye520ww]

Closed as part of PR consolidation; no branch data was deleted.

[luoye520ww]

Reopened for targeted CI repair and verification; this PR remains in the active fix set.

[XingYu-Zhong]

感谢这组可靠性工作。关闭当前聚合 PR 的原因是它将 CI 诊断/flake 注册、打包 smoke 修复、存储统计和清理策略混在同一变更中；当前 develop 已有更新的跨平台 smoke 修复，旧实现也已冲突。

其余工具多数尚未接入实际工作流，存储扫描还存在符号链接/检查时序问题，因此不适合整体合入。

请按独立可交付能力基于最新 develop 重开：例如已接入工作流的 CI 诊断、独立且竞态安全的存储统计、或由实际删除 owner 驱动的清理策略。当前分支会保留。