fix(sidebar): 二轮独立验证的 9 项缺陷 + 目录级暂存

verifier 二轮报告（F1–F9）全部修复，每条都有「临时回退即变红」的判别性验证：

- F1【高】中文等非 latin1 下载名 → 真实宿主 500：content-disposition 改用
  RFC 5987（ASCII 回退 + filename*=UTF-8''）；补真 node:http 用例与根因对照断言
- F2【中】多选同名文件归档重名（解压互相覆盖）：冲突项逐级上溯父目录消歧
- F3【中低】maxBytes 在读完之后才判定；budget<=0 的 0 字节 FIFO 会永久阻塞：
  改为先 stat、读取前拒绝（FIFO 探针验证）
- F4【中低】SSH 模式 + 宿主不可用时 reveal 整条消失：保留 kind==='reveal' 目标
- F5【低】图钉嵌套交互语义非法且键盘不可达：改为诚实的鼠标热区，键盘入口归设置面板
- F6【低】变更树空闲 tick 全量重渲染：行 memo + 恒定 props + 内容键派生 +
  共享 store 的 sameStatus 保住快照身份
- F7【低】排序随运行时 locale 漂移：显式 'en' collation + 码点兜底
- F8【低】POSIX 文件名的反斜杠被当成层级：不再替换
- F9【低】打包中重复点击静默、无反馈：busy 行（role=status）+ in-flight 守卫
- 新增：目录行「暂存/取消暂存该目录」（git pathspec 语义，不触发折叠）

验证：typecheck / lint / test（134 文件 1441 通过）/ build 全绿；
DSH_CMD='npx -y --package @deepseek-ai/dsh@0.1.7-rc.1 dsh' pnpm test:mount 7/7 通过

src/client/open-with.ts

@@ -137,9 +137,15 @@ function customIdOf(id: string): string {
 
 /**
  * The menu-visible open targets, in order (built-ins then custom editors).
- * In SSH mode the local-only targets (the OS file manager, Zed, custom
- * editors without the VSCode dialect) are dropped — they cannot reach a
- * remote path. Unknown pinned ids are pruned here too.
+ * In SSH mode the local-only URL openers (Zed, custom editors without the
+ * VSCode dialect) are dropped — they cannot reach a remote path. The
+ * `explorer` target is NOT dropped: it reveals a path in the file manager of
+ * the machine that owns the workspace, which is exactly where the host half
+ * runs, and it is the only reveal left when the DSH host's own open-in-app
+ * capability is unavailable (older host, no desktop session). A headless
+ * remote cannot raise a file manager anyway — that is the same silent
+ * no-op the other external launches already have. Unknown pinned ids are
+ * pruned here too.
  */
 export function resolveOpenWithTargets(config: OpenWithConfig): OpenWithTarget[] {
   const ssh = config.sshHost.trim() !== ''
@@ -156,7 +162,7 @@ export function resolveOpenWithTargets(config: OpenWithConfig): OpenWithTarget[]
         localOnly: !editor.isVscodeFamily,
       })),
   ]
-  return targets.filter(target => !(ssh && target.localOnly))
+  return targets.filter(target => !(ssh && target.localOnly && target.kind !== 'reveal'))
 }
 
 /** The SSH hint appended to a target's label in remote mode. */