Resolve host paths before mounting them, and stop reading stored data as choice

Four fixes that share a shape: a value already on disk, or one spelled
around a check, being taken at face value.

`/..` bind-mounted the entire host filesystem read-write. `is_filesystem_root`
was purely lexical — trim trailing separators, refuse what was left only if it
was empty or a bare `C:` — and nothing in the file ever called `canonicalize`,
so `/..`, `/./`, `/home/..`, `/etc/../` and `C:\..` all passed. The daemon
resolves them: `docker run -v /..:/mnt/probe` mounts the host root, and the app
mounts read-*write* into a container whose agent has passwordless sudo. It is
the escalation `check_mount_name_stays_under_workspace` exists to close,
reached through the host-path half of the mount instead of the mount-name half.

`classify_mount_source` replaces it and asks the OS: `canonicalize` applies
`..`, follows symlinks, and resolves 8.3 aliases and UNC spellings on Windows.
A path that cannot be resolved — `projects.json` synced from another machine,
a folder not created yet — falls back to a lexical collapse rather than being
refused, because refusing would make such a project unsavable; the gap is
bounded, since what resolution adds is a property of paths that exist. A path
that names no location at all (`C:x`, a relative path) is refused rather than
guessed at. Same check now guards `ssh_key_path` and `ca_cert_path`, whose
read-only mounts were whole-host disclosure at /tmp/.host-ssh.

Custom env var names had no charset check anywhere, so `BASH_FUNC_stat%%` —
bash's wire format for an exported shell function, body in the value — reached
the container environment verbatim. Latent today because the image's /bin/sh is
dash, but the pre-commit scrub runs `/bin/sh -c` as root and nothing pins that.
Keys are now shell identifiers, on the project and the global list both, with
the same grandfathering the folder rows get: a stored key is admitted, a new or
edited one is not.

The blank workspace row was persisted. The comment said it was dropped on save;
the code computed the filtered list and then saved the unfiltered one, so
"+ Add folder" plus a blur stored `{"Target": "/workspace/", "Source": ""}` and
the project could never be started or recreated again. Every save in the
section now goes through one filter, and a blur that changed nothing saves
nothing.

Widening the five `ClaudeCodeSettings` booleans to `Option<bool>` reinterpreted
every stored record. They were plain `bool`s that always serialised, so every
project ever saved carries an explicit `"env_scrub": false` that nobody chose —
and under the new merge that `Some(false)` beats a global `Some(true)`, where
the old rule let the global win. Upgrading silently turned five settings off,
"strip credentials from subprocess environments" among them. Deserialisation
now goes through a shim that dates the record by the presence of the
pre-widening `enable_session_recap` key and reads its `false`s as unset. The
fields skip serialising when unset, so an older binary can still parse
`projects.json` after a downgrade — a `null` would fail to parse and take the
whole list down, since `ProjectsStore` parses all-or-nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src/components/projects/ClaudeCodeSettingsEditor.tsx

@@ -37,15 +37,20 @@ export const CLAUDE_CODE_DEFAULTS: ClaudeCodeSettings = {
  * overrides a global on, so a settings object holding one has to be persisted.
  */
 function isAllDefaults(s: ClaudeCodeSettings): boolean {
+  // `== null`, not `===`: an unset field is *absent* on the wire, not null.
+  // The Rust struct skips serialising one it has no value for, so a project
+  // whose stored settings were all "unset" arrives here as `{}` — and reading
+  // that as "off" is exactly the mistake the three-state control exists to
+  // avoid. See the note on `ClaudeCodeSettings` in `lib/types.ts`.
   return (
-    s.tui_mode === null &&
-    s.effort === null &&
-    s.auto_scroll_disabled === null &&
-    s.focus_mode === null &&
-    s.show_thinking_summaries === null &&
-    s.session_recap_disabled === null &&
-    s.env_scrub === null &&
-    s.prompt_caching_1h === null
+    s.tui_mode == null &&
+    s.effort == null &&
+    s.auto_scroll_disabled == null &&
+    s.focus_mode == null &&
+    s.show_thinking_summaries == null &&
+    s.session_recap_disabled == null &&
+    s.env_scrub == null &&
+    s.prompt_caching_1h == null
   );
 }
 
@@ -204,7 +209,7 @@ export default function ClaudeCodeSettingsEditor({
         // `stored` holds the deviation from Claude Code's default, so an
         // inverted field reads back the other way round — see BOOLEAN_FIELDS.
         const selected =
-          stored === null ? "global" : (invert ? !stored : stored) ? "on" : "off";
+          stored == null ? "global" : (invert ? !stored : stored) ? "on" : "off";
 
         return (
           <SwitchRow