fix(macapp): restore conversation delete and undo preview confirmations

[dennisonbertram]

Parent: #991
Depends on: #995

Summary

Conversation deletion executes immediately from a context menu, and Undo executes immediately from several surfaces. This regresses the completed #933 and #935 contracts, which require delete confirmation and an undo preview/picker describing what will be removed.

Evidence

• macapp/Sources/GoCodeUI/SessionsView.swift:50-60,108-110 — Delete calls the API with no confirmation.
• macapp/Sources/GoCodeUI/ConversationChrome.swift:33-36 — Undo last turn executes immediately.
• macapp/Sources/GoCodeUI/ChatView.swift:350-357 — message action Undo executes immediately.
• macapp/Sources/GoCodeUI/SettingsView.swift:195-199 — project action Undo executes immediately.
• macapp/Sources/GoCodeUI/ProjectSession.swift:374-381 — undo accepts a count and sends it with no preview model.
• feat(macapp): conversation and session picker #933 acceptance: “Delete with confirmation.”
• feat(macapp): fork and undo #935 acceptance: undo picker shows what will be removed; 409 undo_crosses_compaction is explained plainly.

Scope

• Add one confirmation flow for conversation deletion showing title and irreversible data loss.
• Add an undo preview/picker showing the prompt(s)/steps that will be removed before POST.
• Route every Undo entry point through the same presentation/state.
• Explain undo_crosses_compaction with a user action/next step.
• Keep the active-run guard from the prerequisite slice.

Tests first

• Regression: neither DELETE nor undo POST fires before explicit confirmation.
• Cancel/Escape leaves conversation and transcript unchanged.
• Confirm sends the exact selected conversation/count/step once.
• Structured undo_crosses_compaction maps to plain-language UI.
• Production-reachability tests cover every existing Delete/Undo entry point.

Acceptance criteria

• Delete always requires confirmation naming the conversation.
• Undo always previews what will be removed and requires confirmation.
• All entry points share one behavior; no bypass remains.
• Cancel is the safe default and receives initial keyboard focus.
• feat(macapp): conversation and session picker #933/feat(macapp): fork and undo #935 contracts have durable regression coverage.
• swift test, Swift build, formatting, strict format lint, and manual keyboard smoke pass.

[dennisonbertram]

Repair reconciliation for PR #1021:

The shared delete/undo confirmation implementation remains in scope. Automated coverage will be retained while latest-request/lifecycle changes are repaired. Installed-app confirmation cancellation and keyboard interaction proof remain explicitly pending until the coordinated native smoke phase.

[dennisonbertram]

PR #1021 repair is pushed at 575b670938821f9db8b5bb096e3956753b0f0e25. #996 confirmation behavior remains intact after the current-main merge; lifecycle guards and disabled reasons now prevent destructive paths while busy. Full Swift (303 tests / 55 suites) passes; installed-app confirmation smokes remain under #1020.