Resolve host paths before mounting them, and stop reading stored data as choice

Four fixes that share a shape: a value already on disk, or one spelled
around a check, being taken at face value.

`/..` bind-mounted the entire host filesystem read-write. `is_filesystem_root`
was purely lexical — trim trailing separators, refuse what was left only if it
was empty or a bare `C:` — and nothing in the file ever called `canonicalize`,
so `/..`, `/./`, `/home/..`, `/etc/../` and `C:\..` all passed. The daemon
resolves them: `docker run -v /..:/mnt/probe` mounts the host root, and the app
mounts read-*write* into a container whose agent has passwordless sudo. It is
the escalation `check_mount_name_stays_under_workspace` exists to close,
reached through the host-path half of the mount instead of the mount-name half.

`classify_mount_source` replaces it and asks the OS: `canonicalize` applies
`..`, follows symlinks, and resolves 8.3 aliases and UNC spellings on Windows.
A path that cannot be resolved — `projects.json` synced from another machine,
a folder not created yet — falls back to a lexical collapse rather than being
refused, because refusing would make such a project unsavable; the gap is
bounded, since what resolution adds is a property of paths that exist. A path
that names no location at all (`C:x`, a relative path) is refused rather than
guessed at. Same check now guards `ssh_key_path` and `ca_cert_path`, whose
read-only mounts were whole-host disclosure at /tmp/.host-ssh.

Custom env var names had no charset check anywhere, so `BASH_FUNC_stat%%` —
bash's wire format for an exported shell function, body in the value — reached
the container environment verbatim. Latent today because the image's /bin/sh is
dash, but the pre-commit scrub runs `/bin/sh -c` as root and nothing pins that.
Keys are now shell identifiers, on the project and the global list both, with
the same grandfathering the folder rows get: a stored key is admitted, a new or
edited one is not.

The blank workspace row was persisted. The comment said it was dropped on save;
the code computed the filtered list and then saved the unfiltered one, so
"+ Add folder" plus a blur stored `{"Target": "/workspace/", "Source": ""}` and
the project could never be started or recreated again. Every save in the
section now goes through one filter, and a blur that changed nothing saves
nothing.

Widening the five `ClaudeCodeSettings` booleans to `Option<bool>` reinterpreted
every stored record. They were plain `bool`s that always serialised, so every
project ever saved carries an explicit `"env_scrub": false` that nobody chose —
and under the new merge that `Some(false)` beats a global `Some(true)`, where
the old rule let the global win. Upgrading silently turned five settings off,
"strip credentials from subprocess environments" among them. Deserialisation
now goes through a shim that dates the record by the presence of the
pre-widening `enable_session_recap` key and reads its `false`s as unset. The
fields skip serialising when unset, so an older binary can still parse
`projects.json` after a downgrade — a `null` would fail to parse and take the
whole list down, since `ProjectsStore` parses all-or-nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/ClaudeCodeSettingsEditor.test.tsx

@@ -193,4 +193,27 @@ describe("ClaudeCodeSettingsEditor", () => {
       expect(screen.getByRole("switch", { name: label })).toBeChecked();
     });
   });
+
+  /**
+   * A settings object with nothing set at this level arrives as `{}`: the Rust
+   * struct skips serialising a field it has no value for, which is what keeps
+   * an older binary able to parse `projects.json` after a downgrade. It is also
+   * the exact shape a project stored before the fields were widened is read
+   * back as — every one of its `false`s meant "unset" — so reading absent as
+   * "off" would show a switch the user never touched as a deliberate choice.
+   */
+  it("reads an absent field as Global rather than as Off", () => {
+    renderEditor({} as ClaudeCodeSettings, "project");
+    expect((screen.getByLabelText("Env scrub") as HTMLSelectElement).value).toBe("global");
+    expect((screen.getByLabelText("Session recap") as HTMLSelectElement).value).toBe("global");
+  });
+
+  it("still collapses to null when an absent-field object is edited back", () => {
+    const onSave = renderEditor({} as ClaudeCodeSettings, "global");
+    // Off and straight back on: the round trip has to land on `null`, or an
+    // untouched global stops being indistinguishable from one never opened.
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    expect(onSave).toHaveBeenLastCalledWith(null);
+  });
 });