Unify file preview and download behavior

[jonolee-kr]

Human comments

What was wrong

BB used separate file identities, URL builders, preview rules, and download rules across chat, sidebar previews, Tasks, desktop, and mobile. Project attachments used raw new-window links. File routes lacked one MIME and disposition policy. Root compose omitted Markdown file routing. Relative resources lost their source directory. Session-bound URLs could leave BB. The BM-41 audit and runtime reports document the verified failures.

What changed

• Added one typed file identity for workspace, host, thread-host, thread storage, project attachments, Tasks attachments, and remote URLs.
• Added one client resolver for preview URLs, download URLs, supported preview kinds, and explicit error states.
• Added in-app project and Tasks attachment previews.
• Added Download for every byte-backed file, including images.
• Added separate preview and download routes with explicit MIME, disposition, sanitized filenames, nosniff, and active-content sandbox headers.
• Routed chat attachments, user and assistant Markdown links, inline-code references, sidebar files, and Tasks attachments through in-app file handling.
• Resolved relative Markdown links and embedded resources beside their source file.
• Preserved encoded paths, fragments, line ranges, containment checks, safe schemes, size limits, and Tasks authorization.
• Kept same-origin BB windows inside desktop and mobile shells.
• Added byte-preview tab synchronization and legacy Tasks MIME fallback.
• Updated the experimental Plugin SDK contract, audit inventory, and Plugin Guide surface map.
• Changed no host-daemon wire payload, so HOST_DAEMON_PROTOCOL_VERSION did not change.
• Changed no CLI command or user-facing configuration.

How you verified

• Turbo typecheck passed for all 9 affected packages with concurrency two.
• The app production build passed 3 tasks with concurrency two.
• The isolated runtime build passed 8 tasks with concurrency two.
• Focused server route and policy tests passed 106 tests.
• Thread tab contract and public route tests passed 17 tests.
• Focused app resolver, attachment, Markdown, preview, and panel suites passed.
• Desktop window handling passed 11 tests.
• Mobile shell handling passed 12 tests.
• Plugin SDK source and bundled declaration suites passed.
• Plugin API inventory and surface suites passed 16 tests.
• Tasks attachment, CLI, activity, and detail suites passed 58 tests.
• Changing Tasks Download back to inline caused 6 attachment tests to fail. Restoring attachment disposition passed the suite.
• Removing user Markdown file routing caused the new reference test to fail. Restoring routing passed the test.
• Removing legacy Tasks MIME fallback caused the PDF MIME test to fail. Restoring fallback passed the test.
• Chrome 147 validated project and Tasks PDF Open and Download in the isolated deployment.
• Runtime checks validated inline and attachment headers, filenames, line links, missing-file states, and no external page targets.
• Actual Electron, installed native mobile, and a physical mobile WebView were not launched. Their shell paths have focused tests.

Fixes #2697

AGENT GENERATED

[jonolee-kr]

Superseded by the fork-targeted pull request: jonolee-kr#3