feat(chat): move session tasks above the conversation

[devswha]

Summary

• Move the live, read-only session task list from the right workspace rail to a collapsible card above the conversation transcript.
• Show the card only when a plan exists. Keep progress/current work visible while collapsed, bound long-list scrolling, preserve notes/statuses, and reset disclosure state when switching sessions.
• Retire the Tasks rail tab and migrate its saved open state to a closed rail while retaining width. Move the existing todo projection hook into chat ownership without changing its projection logic.
• Add localized accessible task statuses for all ten locales. No dependency, message-storage or installation changes.
• Hide routine Auto-approved … (bypass / always allow / auto-approve edits) info notices in the chat projection. Keep raw records, permission policy, manual approval controls, warnings/errors, ordinary info notices and quoted user/assistant/tool text unchanged. Filtering before grouping also avoids empty rows and split tool-work blocks.

Verification

• npm run verify: passed (audit/licenses/notices, both typechecks, Rust core checks, complete test suite, lint, identity and production build).
• Focused task/rail suites: 38 passing tests; the eight new DOM tests also rerun after final native-button assertions.
• Follow-up auto-approval/permission suites: 36 passing tests across chat projection and all rendered densities, worker policy/gate, and actual permission-banner actions. Full npm run verify rerun after this follow-up.
• Browser fixture using the real component/CSS/React compiler: 1024×768, 390×844 and 320×568; click collapse/reopen, collapsed progress updates, session switching, no-plan removal, 40-task list with a long Hangul path, no horizontal overflow, composer visible, independent task scrolling (task scrollTop 600, chat/page 0), no browser console errors.
• Native button, ARIA controls, focus preservation and keyboard reachability are covered by DOM assertions. Native Enter/Space activation could not be conclusively verified through the in-app browser automation surface and is not claimed as a browser acceptance result.

Delivery boundary

This is an unreleased source change. The published and locally installed beta.10 app is unchanged; a new versioned installer/release is needed to deliver these changes there. No existing release assets or installed app files were modified.

Browser/runtime fixes

• Reproduced the reported top-level await/eval error in real isolated Chromium. Use page-context REPL evaluation with ordinary Promise completion handling; user code runs once, including runtime failures. Preserve CSP, limits, remote-object cleanup and interruption.
• Pass the validated per-run project permission mode into browser/computer wrappers. Bypass omits redundant origin/application questions after target validation, without adding session or persistent grants. Later Ask runs still ask.
• Preserve first Chromium download consent, OS/driver restrictions, genuine questions, cancellation, and non-bypass modes. Model-supplied tool parameters cannot change permission mode.
• Additional checks passed: 21 focused automation/evaluator tests; production SDK-adapter handoff/question contract; real-browser suite (3 tests with await/Promise/error/size/CSP/timeout/close checks); full npm run verify; GJC E2E (8 tests).

These runtime fixes are also unreleased. Installed beta.10 and its published artifacts remain unchanged.