Backport upstream reliability and workflow fixes

[jln13x]

Summary

Backports a focused reliability and quality batch from open upstream T3 Code PRs onto the personal
fork. The changes prioritize Codex correctness, predictable recovery, lower background/streaming
cost, safer diff rendering, and small Git/Desktop quality-of-life improvements.

This PR adds the nine backports not already present in personal:

• fix(shared): fix deepMerge data-corruption bugs and add tests pingdotgg/t3code#4136 — preserve non-plain values during shared settings deepMerge
• Fix repeated steering and reliable stop pingdotgg/t3code#3903 — acknowledge repeated Codex steering precisely and make root Stop resolve the live turn
• fix(chat): unwrap raw JSON provider error payloads into readable messages pingdotgg/t3code#3830 — show readable Codex provider errors without losing diagnostic detail
• fix(web): keep oversized diff lines from locking the UI pingdotgg/t3code#2338 — prevent pathological oversized diff lines from locking the UI
• fix(web): use WASM engine for diff highlighting pingdotgg/t3code#3885 — use Oniguruma WASM for diff highlighting with a narrowly scoped Electron CSP allowance
• fix(desktop): handle EPIPE errors on stdout/stderr to prevent crash dialog pingdotgg/t3code#4213 — suppress only closed-pipe EPIPE errors during Electron shutdown
• Honor configured protocol for automatic repository clones pingdotgg/t3code#4205 — prefer HTTPS for automatic Create & Clone flows
• fix: auto-retry the startup error boundary on focus/online so a recovered backend un-sticks the app pingdotgg/t3code#3520 — retry the startup error boundary on focus, visibility, or network recovery
• [codex] keep completed assistant copy actions visible pingdotgg/t3code#4107 — keep completed assistant-message actions visible

personal already contains pingdotgg#4009 and pingdotgg#4187 through PR #15. This branch keeps those implementations,
adds explicit cursor-page regression coverage for pingdotgg#4187, and consolidates all eleven entries in the
upstream integration ledger rather than replaying duplicate code.

Local adaptations

• Fix repeated steering and reliable stop pingdotgg/t3code#3903 excludes upstream branch-detail notes, workspace configuration, and lockfile changes.
• Reduce background Git ref and port polling pingdotgg/t3code#4187 retains the implementation already reconciled with the fork's PR/ref behavior.
• fix(web): keep oversized diff lines from locking the UI pingdotgg/t3code#2338 is adapted to the current AnnotatableCodeView: oversized files stay collapsed with an
  explanation while their headers can still open the file in an editor.
• fix(web): use WASM engine for diff highlighting pingdotgg/t3code#3885 grants only wasm-unsafe-eval, not a broader renderer CSP exemption.
• The backports remain unflagged because they correct or harden existing behavior rather than add
  fork-specific product behavior.

Full behavior, reconciliation notes, and future upstream-sync expectations are documented in
docs/upstream-integrations.md.

Verification

• vp check — passed with 0 errors and 11 existing warnings
• vp run typecheck — passed
• vp test — 637 files passed, 2 skipped; 5,186 tests passed, 7 skipped
• git diff --check origin/personal...HEAD — passed

An isolated web runtime/pairing smoke passed before the final rebase. Packaged Electron and semantic
browser click-through verification were not available in this environment; the affected paths are
covered by focused regression tests and the full suite.