fix(macapp): guard conversation lifecycle actions while a run is active

[dennisonbertram]

Parent: #991
Depends on: #994

Summary

New/open/fork/undo actions remain available while the current run is active. Opening or resetting a conversation cancels the local stream task without cancelling or continuing to observe the server run, which can leave active work running off-screen.

Evidence

• macapp/Sources/GoCodeUI/ConversationChrome.swift:31-36 — New/Fork/Undo are available without an isBusy guard.
• macapp/Sources/GoCodeUI/ConversationRail.swift:90-94 — a saved conversation can be opened during an active run.
• macapp/Sources/GoCodeUI/ChatView.swift:339-357,901-903 — Fork, Undo, and New are not disabled by busy state.
• macapp/Sources/GoCodeUI/RunSession.swift:177-198 — load/reset cancel the local stream and retarget state; they do not stop the server run.
• Completed feat(macapp): fork and undo #935 explicitly required Fork and Undo to refuse while active with a reason.

Impact

Users can lose visibility and control of a live run, then start navigating or mutating the conversation as though it were idle. The server may continue work after the GUI stops following it.

Scope

• Centralize whether conversation lifecycle actions are allowed.
• Disable New/Open/Fork/Undo/Delete/rewind while a run or control request is active, unless an explicit “Stop & Continue” flow is chosen.
• Explain the disabled reason in help/accessibility text.
• If Stop & Continue is offered, wait for acknowledged terminal state before changing conversations.
• Keep background/cron conversation-wide events working after the guard.

Tests first

• State-matrix tests for every lifecycle action across idle/running/waiting/cancelling/control-failed states.
• Regression: switching/new conversation during an active run does not cancel the local stream or mutate conversationID.
• Live daemon smoke proving an active run stays visible until stopped/completed.

Acceptance criteria

• Conversation lifecycle actions cannot silently detach from an active run.
• Fork and Undo meet the completed feat(macapp): fork and undo #935 busy-state contract.
• Disabled controls state the reason to mouse, keyboard, and VoiceOver users.
• Any Stop & Continue path waits for server acknowledgement.
• swift test, Swift build, formatting, strict format lint, and live daemon smoke pass.

[dennisonbertram]

Repair scope for PR #1021 after independent review:

• Add latest-request ownership for open-conversation/reload paths.
• Add the missing rewind busy guard and reconcile disabled/help/accessibility reasons for lifecycle controls.
• Preserve merged [Bug]: Replay completed scheduled runs across conversation SSE reconnect gaps #1008/[Bug]: Preserve failed and cancelled states during durable transcript reconciliation #1028 conversation replay and terminal reconciliation.

External cron/callback run-control binding remains owned by #1007 and will not be implemented here. This PR will verify that #995 guards use observable active transcript state where available and will document the remaining #1007 dependency rather than duplicating it.

[dennisonbertram]

PR #1021 repair is pushed at 575b670938821f9db8b5bb096e3956753b0f0e25. #995 now exposes one shared lifecycle disabled reason, rechecks busy state after awaits, guards rewind/current-conversation delete, and treats external conversation-stream activity as busy. It intentionally does not bind external run-control identity; that remains #1007. Lifecycle/request-ownership coverage passes.