fix(desktop/read): reconcile keep-cursor, AuthorNav watch, table grid nav, frame check (#322)

[agentfleets]

Closes #322

The maintainer's recorded remaining tail of the ReadSurface bundled UX fixes (the god-file split stays deferred per the issue comments). All six items, no more.

What

• External-write reconcile keeps cursor + undo — an agent onInsert (or PDF "+notes") used to full-document-replace the open editor. The Milkdown/Crepe editor now routes a pure append through one minimal ProseMirror end-of-document transaction (falls back to replaceAll for anything else); the CodeMirror source editor dispatches only the minimal changed span (common prefix/suffix trimmed). Selection is mapped across the change and undo stays granular in both.
• AuthorNav file watcher — externally added/changed files appeared only after a manual refresh. src-tauri exposes no fs-watch, so the nav polls the existing depth/entry-capped workspace_list every 4s (skipped while the window is hidden) and swaps the tree only when it actually changed — expanded dirs keep their state since rows key by path.
• TableEditor keyboard grid navigation — Enter moves down (cells commit per-change), Tab/Shift-Tab walk cells row-major (edges leave the grid natively), arrows move between cells only where they steal nothing native: text caret edges for text inputs, never for number/date stepping or select option-cycling.
• BrowserView refused-frame detection — the static X-Frame-Options hint bar is gone. Each navigation preflights the page's framing headers through a new minimal Rust frame_check command (reqwest, headers only; unreachable ⇒ not refused) and a refusal renders an actionable error with an openExternal escape hatch.
• No more t() prop-drilling in PdfCanvas — AnnoEditor and AnnotationList call the memoized useT() locally; PageView loses its forward-only t prop.
• Dedups — one shared MarkdownOutline rail (was near-verbatim copies in MarkdownReader + NoteTab); one useNotesMode hook for the persisted notes-mode state (was ReadSurface + NoteTab); one exported CHART_PALETTE in ChartView (CompareSurface swatches now share it).

Why

Each is a recorded remaining item in the #322 comments ( Milkdown reconcile keep-cursor, AuthorNav watcher, TableEditor grid nav, BrowserView refused-frame detection, t() prop-drill, and the outline/notes-mode/palette dedups).

How verified

• npm run build (sync:tokens + tsc --noEmit + vite build) — green.
• scripts/lint-desktop-tokens.sh — clean (counts only decreased: the removed .browser-hint rule; new CSS uses semantic spacing tokens only).
• i18n zero-drift: read.browserFrameHint → read.browserFrameRefused swapped in BOTH en and zh (1171 = 1171 keys, no drift).
• The one Rust addition (frame_check in lib.rs, registered in the invoke handler) is CI-verified only — no local toolchain; it reuses net::client_builder + existing reqwest/redirect/timeout idioms and was re-read for syntax/borrow correctness.

[physercoe]

APPROVE. Well-scoped #322 tail. The load-bearing uncontrolled-editor echo-loop rule is honored (lastEmitted set to the serialized output, not the incoming value → round-trip compares equal, no loop, no dropped write). AuthorNav watcher has stable deps + JSON-equality guard + path-keyed rows (expansion survives tree swaps); table grid-nav bounds correct with no focus trap; frame-check defaults to Ok(false) on unreachable so the iframe still gets its chance. Nits only (inline-append parses as new paragraph; per-nav GET; useNotesMode.pick not useCallback-d).