Bound hidden-session applied-index resolution work

[baron]

Summary

• precompute hidden-session worktree binding and slice contexts once per applied-index event
• replace full root snapshots and per-file linear scans with keyed applied-index lookup
• collapse worktree binding-state resolution to one persistent authority scan
• strengthen bounded-work regression coverage for multi-file events and ambiguous/missing bindings

Production evidence

Sampling production PID 81263 placed 5,490/6,260 main-thread samples (87.7%) in handleHiddenSessionRootAppliedIndexEvent, including 5,464/6,260 (87.3%) in hiddenSessionSliceRebaseTargets. The sampled path repeated persistent binding resolution and workspace/file scans for each modified file.

This changes the hot path from repeated per-file authority/workspace scans to one authority pass per event plus keyed file lookup and cheap synchronous per-file projection.

Validation

• Fable 5 High planning/check and independent review: no must-fix findings
• make dev-format: pass
• make dev-lint: pass
• make dev-swift-build PRODUCT=RepoPrompt: pass
• AgentModeViewModelInactiveRefreshTests/testAmbiguousPersistentBindingFailsRoutingWithoutLeakingCandidates: pass
• PersistentAgentModeMCPReadFileConnectionTests/testAgentOwnedHiddenWorktreeWatcherRebases6500LineReadSlicesBeforePostEditReads: pass
• commit and push contribution preflights: pass

Known unrelated validation noise

• Full root PR-ready execution was stopped after 34m because it had already produced failures in unrelated Codemap binding/projection/graph tests outside this five-file diff.
• Ledger verification enumerated authoritative root/provider tests successfully, then reported an existing WorkspaceProjectedPathSearchTests baseline mismatch (3 missing, 2 stale); none of those rows are changed here.