Fix localized Inbox pause recovery / 修复收件箱暂停恢复与本地化

[SivanCola]

Summary

• localize paused and sibling Inbox product-state errors in English, Simplified Chinese, and Traditional Chinese
• expose an actionable recovery banner for ordinary paused queues, not only restart-recovered queues
• recover same-process orphaned in-flight guidance into paused, reviewable work instead of leaving immutable zombie items
• make guidance actions reflect durable state: active items are protected, while uncertain and blocked items have an explicit retry path

Fixes #8276.

User-visible behavior

Chinese desktop sessions now show 收件箱已暂停 instead of the raw backend text inbox is paused. Capacity, invalid-state, read-only, and workspace-startup errors on the same Inbox path are localized as well.

If an accepted/running guidance item loses its live Controller owner, the next snapshot safely pauses the Inbox and changes the item to uncertain. The user can review it, continue, then retry or delete it. Guidance that is still actively owned cannot be sent or deleted again, and the UI explains that it is already being applied.

Root cause

Known Inbox states crossed the Wails boundary as English error.Error() text, and Composer toast paths rendered that text directly. The frontend also propagated pause state only for recovered snapshots, so an ordinary paused queue could still expose the guidance action without a resume surface.

For #8276, the normal rejected-steer path already rolls steer_accepted back to queued; the durable failure window was instead same-process ownership loss. Persisted running / steer_accepted / steer_consumed records were only recovered across process restarts. A live process could therefore retain an in-flight record after its Controller owner disappeared, while the shelf continued presenting queued-item actions. Claim-to-owner and owner-to-ack boundaries also needed serialization against snapshot recovery.

Changes

• encode known Inbox errors as stable reasonix_error:<code> values while preserving Go error unwrapping
• translate stable codes at display time and accept legacy English strings for compatibility
• preserve unknown diagnostic errors verbatim
• propagate receipt and snapshot pause state into the guidance shelf
• disable guidance admission while paused and offer review/resume/keep-paused actions
• atomically recover unowned in-flight records to uncertain, with a fast no-candidate path that keeps ordinary snapshots lightweight
• serialize durable claim, live ownership, and durable acknowledgement against orphan recovery
• disable send/delete for live in-flight items and expose localized retry actions for uncertain / blocked items
• localize the queued-after-turn-ended guidance notice
• localize cancellation context and nested Inbox errors in the active locale

Verification

• go test ./...
• go test -race ./internal/control ./internal/sessioninbox
• deterministic claim-to-owner and owner-to-ack interleaving tests
• cd desktop && go test . -run 'Inbox|Steer' -count=1
• cd desktop/frontend && pnpm test:typecheck && pnpm test
• Composer Inbox recovery regression test: 20 passed
• cd desktop/frontend && pnpm build (typecheck, hooks lint, CSS/WAAPI checks, Vite build, bundle budgets)
• make lint
• real Chromium DOM/click verification in zh-CN: retry is disabled while paused, enabled after 继续执行, carries the accessible name 重试这条引导, and clicks successfully

Two unrelated desktop full-suite tests each failed once due existing temporary/global-state flakiness (TestApplyLinuxVersionedActivatesWithoutPersistingGuard and TestRemoveWorkspaceClearsActivePointerWhenRemovingCurrentWorkspace); each passed 10 consecutive focused reruns. The desktop Inbox/Steer integration set passed.

Compatibility and risk

• persisted schema, state enum, Wails method signatures, and JSON fields are unchanged
• recovery reuses the existing uncertain, paused, retry, and delete contracts
• new frontend code accepts both stable codes and legacy English errors
• old frontends can review/resume and directly retry recovered uncertain items; new frontends use the already-existing RetryInboxItem bridge method
• unknown diagnostics remain unchanged
• no prompt, provider serialization, tool schema, cache prefix, dependency, permission, or network behavior changes

Documentation-impact: none - Existing Inbox documentation remains correct; this change localizes runtime errors and makes existing recovery semantics reachable for same-process orphaned items.