fix(launcher): recover search errors and expose queued index work

[jewei]

Summary

Closes second-review findings C and D, following merged watcher (#18) and automatic privacy cleanup (#19) fixes. Separate implementation commits are retained.

• Report file indexing as queued, scanning, idle, disabled, or failed. Pending work remains queued throughout cooldown/settling; changed roots do not look like a finished empty scan. Preserve generation cancellation, bounded/coalesced work, publication lock order, and the resource/rest policy.
• Successful current background searches clear only search-owned errors. Action/startup failures have separate ownership; obsolete replies cannot dismiss a newer failure. Explicit user dismissals are preserved.
• Update exact Rust/TypeScript contracts, fixtures, the profiling harness, and feature docs.

Verification and reviews

• Full combined local verification: 44 verifier tests, 253 Rust passed (7 existing default ignores), 233 mocked-IPC browser tests, formatting/types/build/Clippy. Both standalone profiling compile modes passed.
• Final focused run: 37 passed, with successful traces and queued/disabled screenshots retained. Source 9e6d80c72153e622867f0484138320e426fffb7b and current-base head e464cdd6b8f677565e2cdf947a0f6b1c249cd35d have the identical reviewed tree 6ff4930cb4238b9f187de76cc88d8132808971ce.
• Negative controls: reporting pending as idle fails the worker test; omitting search-error clear fails the same-query browser journey. Restored code passes. Generated canonical Rust fixtures reproduce without drift.
• D: independent approvals 54df7427-982a-4d2 and 7ed4808f-a2d2-421, including focused browser checks.
• C: initial independent review 21d859bb-d94f-454 found a late-disable watcher-disposal gap; a7d933c0-6c2e-475 approved the initial source. The gap is repaired: rejected begin reconciles actual watcher ownership before relabeling a generation, accounting disposal and preserving rest.
• The new deterministic production-worker regression performs real watcher registration, disables exactly after the final budget callback, observes completed watcher destruction, and verifies re-enable waits for disposal rest. Restoring the original ordering fails with obsolete watcher retained after late begin rejection without hanging; repaired code passes. A test-hook type-alias repair preserves Clippy's unchanged strict lint gate.
• Two fresh independent final repair approvals: bd0bf756-cde2-4b9, 290ce8bc-8dd1-4b7. All reviews are subagent reviews, not human GitHub approvals.

Final current-base protected CI 36402498211 passed, including all three platform builds/tests, all 233 browser tests, installed Windows/Linux native journeys, and Required checks. The late-disable regression passed on all three OSes. Verification-tools run 36402497297 also passed.

Both native records have clean, unchanged, matching build/test source 21fa06ea2b0070d3740098585e0606d69869ef74, with reviewed tree 6ff4930cb4238b9f187de76cc88d8132808971ce. Both record 28 passed native journeys, complete cleanup, and 100 retained schema-2 timing samples (25/scenario). Windows additionally covers upstream-clear cleanup through SQLite contention; Linux does not implement that heuristic.

• Windows installer SHA-256: a0523559e76441b8de0effa2ec1ff087d9e77fa8e226ff9c503dda5fdcd1febf.
• Linux package SHA-256: 826d3d4e08b1e9272f38d2085ab4c3179daf7c43c84cc464bf24966d9b385033.
• UI screenshots: browser evidence artifact, browser/launcher-file-refresh-dist-7506d--and-finished-empty-results/files-queued.png and browser/launcher-file-status-follo-e6ecc-owing-a-finished-empty-scan/files-disabled.png. Downloaded and inspected; focused successful traces are also retained locally.

Branch protection was rechecked unchanged: strict app-bound Required checks, administrator enforcement, PR/conversation requirements, no force push/deletion. No bypass.

Browser tests mock IPC. Controlled worker clocks do not measure OS scheduling/disposal latency. No controlled macOS/Wayland native, physical-paint, historical installed-version upgrade, or universal performance claim. No production release.