[stevenmunn312-tech]

Fix the five highest-ranked findings from the 2026-10-29 bug hunt. This targets Hardware, where the findings were reproduced.

• Flush and clear pending history on project loads so undo cannot restore another project and autosave it under the current name.
• Restore trust safely during undo/redo without remembering unknown code as trusted.
• Capture and restore complete recovery workspaces, including custom display documents and music metadata, with an explicit undo/redo checkpoint.
• Flush pending edits before entering a group so root history cannot enter the group's undo stack.
• Give each build a cancellation token across subprocess phases and streaming worker changes. Capacity checks do not own the upload Cancel button. Cancellation returns a nonzero sentinel even when the compiler exits successfully.

Validation:

• Full frontend suite: 522 files passed, 7 skipped; 8,643 tests passed, 138 skipped (npm test -- --maxWorkers=3).
• Full backend suite: 304 tests passed (python -m pytest backend/tests -q).
• npm run lint and npm run build passed. Vite retains circular-chunk and chunk-size warnings.

Regression tests cover project switching, group navigation, foreign-code trust, recovery undo/redo, overlapping builds, startup races, cancellation between compile and upload, and abandoned-stream cleanup. No hardware flashing was performed.