Present Quick Undo and Redo as governed revision history

[mberrys]

Quick Undo and Redo now navigate governed revision history. Undo of a published correction runs Core's forward rollback gateway and creates a new PDF; reopening reconstructs Undo/Redo from the retained chain. The Fix workspace shows revision digests, approvals, and publication receipts, with confirmation bound to the displayed revision.

Rollback closes the GUI history connection before dispatching the worker, so the worker can snapshot a checkpointed history. Editor Action List publications retain unique sibling PDFs and carry verified history/artifacts into each new sidecar. A new correction clears Redo. Failed revalidation, stale confirmation, cancellation, and stale completion preserve approved source revisions and receipts.

The approved Core extension accepts a retained original input only when it matches the input of the accepted execution being undone and the request's current digest matches that execution's output. Existing request types and persistence schemas remain unchanged.

Closes #124.

Validation and handoff:

• Exact source commit: 1be5f5a7ce0af39afbc7c3933d921519126630c7; base dev at b08e218360306665f86931b311e641884f818925.
• Local EditorHost suite: 42 passed, 0 failed, 0 skipped, including history acceptance; ShellWorkspace: 13 passed, 0 failed, 0 skipped. Both complete suites also passed two consecutive CTest runs (--repeat until-fail:2, 122.90 s).
• Fixture artifact SHA-256 from the final gate: original/Undo d1722e46610ede47bcecbf91d74b8a28a3d36d78b5cac4f3ca793b78f8f823d9; published/Redo 09530d36fa3774bee386a50f099ccb30a034fb30e2c8fe21973dacf3cd642f3f; reopened chain contained 6 events before further multi-correction checks.
• Windows fixture repair: assertion logs identified recipe-state contamination in the shipped-recipe/default-selection and correction-sample cases. Each case owns a temporary recipe directory passed through the internal Editor/Catalog constructors. Production keeps the existing default directory and canonical application identity; the identity guard remains unchanged.
• Product journey fixtures now use temporary copies of the committed source bytes; the CTest run of UnitTestsProductOperatorLoop passed and left the checkout clean. Architecture bindings, the six identity-contract tests, seven onboarding tests, and two governed-parity script tests passed.
• Required gate PASS on the exact final head: 106 checks passed, including all 70 mapped suites (0 failed; 399.61 s), affected builds, formatting, static analysis, and source/architecture contracts. Command: python scripts/agent/check-change.py --base origin/dev --build-dir <approved-external-build> --report <external-report>.
• History fixtures: UnitTestsOperationHistory::rollbackToOriginalRequiresTheAcceptedExecutionBeingUndone and UnitTestsEditorHost::fixJourneyPublishesOnlyAnApprovedPlanBoundToTheDisplayedIdentity, plus fixRollbackReturnsToARecordedRevision. They cover publish/rollback/reopen, multiple Undo/Redo transitions, a new correction clearing Redo, stale confirmation, refused revalidation, tampered input, and retained approved events/receipts.
• Quick smoke: ProductQuickAccessibilitySmoke --preview-fixtures loop-preflight/testdata/fixtures passed with offscreen/software rendering. This does not qualify installed packages or native accessibility.
• Hosted checks completed on this head with no failures. CI agent-fast build and Fuzz passed. The explicitly skipped qualification lanes are listed below. Local acceptance proof is complete.
• Changed areas: Core history resolution; Interaction publication/history retention; Editor history presentation and commands; mirrored Quick QML; fixtures, catalog, changelog, and evidence manifest.
• Supplementary Python CI discovery on Windows: 459 passed, 7 skipped, and 1 platform failure because the Linux relink fixture could not launch /bin/bash through WSL; the corresponding Linux policy run passed all 467 tests (8 declared skips).
• Unavailable proof: the existing Core independent-validation lane is a declared stub and remains listed in unresolved; installed package/native accessibility qualification is not asserted. The full Linux/Windows qualification jobs run only for stable pushes or manual dispatch and are skipped on this PR; independent-integrity requires a separate dispatch with oracle inputs.
• Remaining behavior: history snapshotting refuses a live SQLite WAL; failed requests can leave a failed-history sidecar. Core-committed rollback artifacts remain retained if owner completion is stale or cancelled.

Anti-slop review: removed shared-directory deletion/helpers and obsolete filesystem-publication commentary. Fixtures pass their owned recipe directories through the internal constructors, with no global identity mutation or test-only production wrapper. Identity, approval, cancellation, provenance, and failure guards remain in place.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}