fix(web): add local dropped folders as path chips

[rynfar]

Dropping a folder into the web composer previously treated it as a file attachment or ignored it. In the desktop local environment, this change resolves the folder's native path and inserts it as an existing composer path chip. Ordinary files in a mixed drop remain attachments.

Folder paths are refused when the thread targets a remote environment, the desktop primary runs in WSL, or the native path bridge cannot establish a usable path. Unreadable or ambiguous directory entries show a warning instead of becoming attachments. Sidebar drops guide users to the composer.

Validation: 21 focused folder/drop tests, composer serialization tests, web and contracts typechecks, scoped lint and formatting. Desktop typecheck retains two pre-existing TS2883 diagnostics in updatesTestHarness.ts. Independent source review passed. No browser/device interaction was performed because this task has no explicit UI automation approval.

Upstream source: d1a644897119300688cbd8bf26e0b64aeb92c382. Adapted for Pylon's environment and WSL path boundaries.

Model: GPT-6 Sol (low), Codex harness.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

Deployment failed for project pylon-marketing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/pylon-code?upgradeToPro=build-rate-limit

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	13.9 KiB	−64 B (−0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+14 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−78 B (−1.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	−88 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	14.0 KiB	13.9 KiB	−44 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−8 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−36 B (−0.5%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.8 KiB	−88 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: 7ed3f71 · PR result: 07bcaa6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.