refactor(app): extract review and file viewer extension

[Hona]

Review and files as a built-in extension

• Move Git review, file trees, file previews, diff viewers, line comments, and "Open in" actions into @opencode/plugin-review-desktop.
• Keep panel layout, ordering, focus, workspace caches, draft attachments, and annotations in the host. The extension owns feature queries, navigation, and review state.
• Compose shared file-tree controls, diff viewers, and mobile layouts. Keep preview sidebars mounted across document replacement and retain the shared wrapping preference.
• Use public Plugin, Client, UI, and Session UI surfaces; no imports from App, Desktop, Core, or Server internals.
• Draft follow-up: migrate the former host review and "Open in" preferences into extension storage.

flowchart LR
  Producers[Timeline and composer file links] --> References[Shared file references]
  References --> Host[Host panel layout]
  Plugin[Review and files extension] --> Host
  Plugin --> Queries[Public client + TanStack Query]
  Plugin --> UI[Shared file and diff components]
  Plugin --> Draft[Host annotations and draft attachments]

Loading

<Panel id={tab} reference={tab} group="files" title={filename}>
  <FileBrowser session={session} />
</Panel>

Before: browser-extension	After: review-extension

Synthetic file-browser fixture; no live-session data.

Production session-switch comparison

Baseline browser-extension (ebe5420755), candidate 37218177cf. Production web renderer, Chromium 147, 400 messages/session, two serial samples per scenario. Median milliseconds; exploratory sample sizes, not a performance-improvement claim.

Scenario	First correct: before	After	Stable: before	After
cold, review closed	277.65	293.20	285.05	320.05
cold, review open	332.75	367.75	405.45	403.15
warm, review closed	64.20	64.80	157.80	118.55
warm, review open	193.15	134.35	294.25	163.55
warm, review resized	200.00	174.25	292.00	263.75

• The session-scoped review viewer still remounts on session switches. The DOM probe records that replacement; cross-session viewer retention remains follow-up work.