Hold back the Disk panel and OS drag-out from the ship branch

This is a scope reduction, not an abandonment. Both subsystems are
preserved in full on `hold/disk-and-dragout` and are intended to come
back once they have been hardened separately. Nothing here is a
judgement that the features are unwanted — three successive
audit-and-fix cycles each closed a critical defect in these two areas
and each opened a new one, so the rest of the round ships now and these
two get their own cycle rather than holding it up.

Removed: the Disk settings panel and its whole reclaim / destroy /
compaction surface — `DiskSettings`, `DiskProjectTable`, `useDiskUsage`,
`docker/disk.rs`, `disk_tests.rs`, the disk commands in
`docker_commands.rs`, and their `generate_handler!` entries. Dropping
the IPC entries is the point: a UI-only removal would have left five
commands callable by a compromised webview, one of them a verified
arbitrary-DELETE primitive. `sweep_orphaned_snapshots`'s *command* goes
with them (the panel was its only caller); the sweep itself stays.

Removed: OS drag-out from the Files tab — `stage_container_file_for_drag`
and its host staging lifecycle, the pointer gesture and `dragPreview`,
`stageForDrag` / `isStagedHostPath`, the `tauri-plugin-drag` and
`@crabnebula/tauri-plugin-drag` dependencies, and the
`drag:allow-start-drag` capability grant, which could not be scoped.
The capability test's expected list is updated; its `*:default` and
`store:*` assertions are untouched.

Kept, deliberately: drag-and-drop *into* the app (Files pane and
terminal) and "Save to host…", which is now the only route out of a
container. The prevention work is untouched — the pre-commit scrub and
`SNAPSHOT_SCRUB_PATHS`, capped container logs, the `triple-c.base` /
`triple-c.managed` labels, `sweep_orphaned_snapshots` and the startup
housekeeping, the migration pin/probe reapers, scheduler log pruning,
`formatBytes.ts`, and `project_lock.rs` in full with every acquisition
site outside `disk.rs`.

Entanglements, resolved rather than deleted blind:
* `container.rs`'s `a_compaction_runs_this_module_s_scrub_script_byte_for_byte`
  pinned the compaction Dockerfile against `snapshot_scrub_script()`.
  Dropped — it existed only for compaction. `snapshot_scrub_script` and
  its containment tests are untouched.
* `lib.rs`'s startup reap of `:compacting` tags and `triple-c-compact-*`
  containers is dropped: nothing on this branch creates them.
* `project_lock`'s `Compaction` / `CacheClear` variants and
  `any_held_excluding`, `migration_commands::is_migrating`, and
  `formatBytes{Delta,Ceiling}` lose their last production caller but are
  kept and still tested, annotated with why.
* `projects_store::corrupt_since` and `migration_store::peek_ownerless_since`
  were read only by the disk survey and are removed. The corrupt-load
  marker and `.bak` are still written.

Verified: `npm run test` 611 passing, `npx tsc --noEmit` clean,
`npm run build` green; `cargo test` 419 passed / 2 ignored,
`cargo build` 0 warnings. Every test removed belongs to a removed
feature — no kept-behaviour test was weakened or deleted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src-tauri/src/storage/projects_store.rs

@@ -13,43 +13,6 @@ fn corrupt_marker_for(file_path: &Path) -> PathBuf {
     file_path.with_extension("json.corrupt")
 }
 
-/// `<data_dir>/triple-c/projects.json.corrupt`, whether or not it exists.
-pub fn corrupt_marker_path() -> Option<PathBuf> {
-    dirs::data_dir().map(|d| corrupt_marker_for(&d.join("triple-c").join("projects.json")))
-}
-
-/// When this data directory last loaded a `projects.json` it could not parse,
-/// as the RFC3339 instant recorded in the marker.
-///
-/// ## Why this outlives the load that wrote it
-///
-/// A corrupt load is *recoverable for the app* — the list starts empty and
-/// everything keeps working — and that recovery is precisely what makes it
-/// dangerous for anything that reasons about which projects exist. The
-/// in-memory symptom does not survive: the first [`ProjectsStore::save`] after
-/// the failure, which is as little as starting one project (`update_status`),
-/// writes `[{that one project}]` over the file. From then on `projects.json`
-/// parses, holds one id, and looks exactly like a user with one project — while
-/// every *other* project's home and config volume is on the daemon claimed by
-/// nobody.
-///
-/// The guard in `project_store_trust` keyed on "the list is empty and the file
-/// exists", which that write silently ends. So the fact is recorded on disk
-/// instead of inferred from the list's shape, and it is **sticky**: nothing in
-/// this app clears it, because nothing in this app can reconstruct what the
-/// unreadable file held. The refusal names the marker so a user who has
-/// restored their list — or accepted the loss — can delete it deliberately.
-pub fn corrupt_since() -> Option<String> {
-    let raw = fs::read_to_string(corrupt_marker_path()?).ok()?;
-    let trimmed = raw.trim();
-    if trimmed.is_empty() {
-        // The marker's presence is the signal; an empty one still means a
-        // corrupt load happened, it just cannot say when.
-        return Some("an unknown time".to_string());
-    }
-    Some(trimmed.lines().next().unwrap_or(trimmed).to_string())
-}
-
 /// Keep the bytes of an unparseable `projects.json`, and record that it
 /// happened.
 ///
@@ -76,15 +39,21 @@ fn record_corrupt_load(file_path: &Path, now: &chrono::DateTime<chrono::Utc>) {
         }
     }
 
+    // Sticky, and written even though nothing in the app reads it back on this
+    // branch: the Disk panel's `project_store_trust` was the reader and went to
+    // `hold/disk-and-dragout`. The marker stays because it is the only durable
+    // record that a project list was lost — the in-memory symptom does not
+    // survive the next save — and because re-deriving *when* it happened is
+    // impossible after the fact.
     let marker = corrupt_marker_for(file_path);
     if marker.exists() {
-        // Sticky: the *first* corruption is the one that dates the loss.
+        // The *first* corruption is the one that dates the loss.
         return;
     }
     if let Err(e) = fs::write(&marker, now.to_rfc3339()) {
         log::error!(
-            "Could not record the corrupt projects.json load at {}: {} — orphan detection will \
-             not know the project list is incomplete",
+            "Could not record the corrupt projects.json load at {}: {} — nothing will be able to \
+             tell later that the project list was incomplete",
             marker.display(),
             e
         );