perf(runtime): bound caches, scans, and background work

[beruro]

Problem

Repository, project, sidebar, benchmark, file-index, and webview paths could duplicate in-flight work, retain unbounded cache/surface state, miss authoritative invalidation, or continue hidden background work beyond the owning lifecycle.

Solution

• Coordinate equivalent reads with retryable single-flight ownership and scope-fence late results.
• Bound file-index/project caches and connect invalidation to authoritative git/project mutations.
• Suspend hidden webview/layout work and cap retained browser surfaces.
• Throttle/coalesce deleted-work-item purge operations.
• Integrate the latest refactor(async): add scoped resource lifecycle #562 base while preserving its newer view-scoped project reads and the current sidebar entity/cursor/generation model.
• Keep sidebar coordinators owned per Jotai store so multiple windows do not share mutable lifecycle state.

The updated branch is based on the current #562 head and GitHub reports it mergeable.

Potential risks

• This is a broad performance/lifecycle sweep; cache invalidation, failed-owner retry, scope identity, and repeated open/close behavior remain the highest-risk paths.
• The sidebar merge combines this PR's single-flight ownership with the newer authoritative roster cursor model. Targeted tests cover overlap, forced refresh, scope changes, pagination generations, and imported-source failures, but full desktop multi-window behavior still relies on CI/E2E coverage.
• Project purge state is bounded to 50 projects and throttled for five minutes; an explicit later purge within that interval returns zero by design.
• This PR depends on refactor(async): add scoped resource lifecycle #562 and should merge/retarget only after refactor(async): add scoped resource lifecycle #562. Rollback is a normal revert after its base lands; no schema, wire, or persistence migration is involved.

Performance audit

Verdict: pass. Active operations keep one owner per scope/store, equal requests coalesce, stronger/scope-changing requests queue one trailing run, late generations cannot publish, caches/surfaces have explicit caps, hidden work suspends, and invalidation is tied to authoritative mutations rather than a new polling loop.

Verification

• ./node_modules/.bin/vitest run src/api/http/project/client.purge.test.ts src/store/session/sessionAtom/__tests__/sidebarLoaders.test.ts — PASS, 2 files / 29 tests.
• ./node_modules/.bin/eslint on the four integration-conflict/test files — PASS, no errors or warnings.
• ./node_modules/.bin/tsc --noEmit --pretty false — PASS.
• git diff --check — PASS.
• Merge of the updated refactor(async): add scoped resource lifecycle #562 branch — PASS after semantic conflict resolution; final diff remains limited to the original 40 performance-lifecycle files.
• Full repository CI is running on the published merge commit.