Deleting a saved cut set destroys work without asking #59

Summary

The Workspace picker places Delete set beside Open folder. An unpinned
set is deleted immediately, with no confirmation, including its saved transform.
Only a pinned set prompts, and that prompt says only that the set is pinned.

src/matteloop/ui/workspace_dialog.py (the picker), src/matteloop/ui/workspace_controller.py
(_delete_selected: delete_workspace then discard_transform, confirmed
only through _confirm_pinned_delete).

Why this matters more than an ordinary delete

A cut set is the expensive artifact. It holds the segmented frames that make
every later export cheap, and it can hold externally edited frames that
re-running segmentation cannot reconstruct. One unconfirmed click can therefore
destroy work that no amount of recomputation brings back.

The model manager already gets this right: removing a weight confirms, with No
selected by default — and a weight is merely a download.

Fix

One confirmation at the top of _delete_selected, for every set. Identify the
set the way the picker row does (source filename, frame count, model), state
that the stored frames and the saved transform will be removed and that
recreating them requires background removal again, add the pin warning when
the summary is pinned, and default to No. The fallback prompt for a set whose
pin flag was stale (the delete raised CUT_WORKSPACE_PINNED) can stay as it is.

The test that proves it

In tests/ui/test_workspace_controller.py: delete an unpinned set and assert a
confirmation is requested and that answering No leaves the set and its
transform sidecar intact. Assert the pinned case still warns about pinning as
well.

Guardrail note

Confirmation dialogs in this codebase are compared by value, not identity:
QMessageBox.question returns an int. See the fix in #38.

Found in the review of 2026-09-05.