Separate registered Work files from verified AUIP applications

[Lucas1479]

Problem and resulting behavior

Ordinary Work files and AUIP applications currently share a view, which obscures what is safe to preview and what can be opened as an application. This change gives them independent counts, recent lists and details. A report delivered beside an app remains a file; app membership comes from verified Host receipts, not directory names or Provider claims.

The Host verifies the current revision, workspace containment and registered digest before serving a bounded text preview. Viewing neither executes HTML nor accepts the WorkItem. AUIP Open/Interact retains its existing Attach boundary and requires registered entry/manifest digests. Provider declarations cannot replace Host business receipts; accepted recovery inherits only unchanged, hashed outputs of its direct predecessor.

Approved external business.export deliveries now appear in Files, including Desktop-only reports. Pending/denied exports and Provider claims are excluded; a newer unapproved export cannot hide the last approved one. Verified exported AUIP members stay with their application. External files are labelled and have no in-app preview, preserving workspace containment. Catalog database/filesystem work runs off the async request thread.

Review and compatibility

• Behavior and synthetic before/after screenshots
• Owning layers: Work ledger/registry and read model; separate file and AUIP source validation; Electron artifact panels.
• No ledger migration or file copying. Older AUIP entries without digests must be registered through the Host-owned delivery path before opening.
• Split from Add experimental extension lifecycle with native Agent bindings #188 so output authority can be reviewed and rolled back independently of plugin installation. This branch is based on main and has no plugin or memory implementation dependency.

Validation

• Final external-export and AUIP regression: 185 passed, 1 skipped across two non-overlapping groups (test_work_artifact_preview, test_project_apps_catalog, test_auip_launch, test_work_export_integration; registry, AUIP source/recovery, recovery requirements, ledger coordinator and model-less smoke unit tests).
• cd electron && npm test: 405 passed; npm run build: passed.
• electron/tests/workArtifacts.smoke.mjs: passed against production components with synthetic mixed delivery, including the external-export label and disabled preview; screenshot updated.
• Ruff and git diff --check: passed.
• Prior split-branch official tools/smoke_electron_model_less.py: 12 checks passed, including separate file/app views, authenticated backend startup and clean shutdown. Latest-head CI reruns the required desktop gate.
• Latest head adf16323: 14 CI checks passed, including the desktop model-less gate. Required CI must stay green through final review.

Keep draft for maintainer/Claude review. A linked design Issue is still required before merge under CONTRIBUTING.md; no merge or release approval is implied.