Fix Windows crash after folder selection

[coneilen]

Summary

Fix the Windows production crash after accepting a folder in the native IFileOpenDialog. The selected path is now owned across a posted application message so project registration and workspace/focus changes begin only after USER32 has unwound the originating WM_COMMAND callback.

Current origin/main (b582fac93e0cf4bb3788e64e646e9a7f2d1063f4) contains the same Windows picker path as immutable beta3 (0958109ee41c7215e3ccf91319e5a102d0fb7069); no existing fix was duplicated. The immutable beta3 candidate remains failed and unchanged.

This PR claims only graphcode-windows/src/App.zig; it does not modify #587's harness files or #560's deferred Worktrees scope.

Changes

• retain the selected UTF-8 path until an app-owned WM_APP completion message is dispatched
• consume each pending selection exactly once and free it on dispatch or app teardown
• surface message-post failures instead of reporting success
• add a hidden native-window regression covering callback unwind, cancel/reselect, duplicate delivery, non-ASCII ownership, and destruction before delivery

Test plan

RED: $env:GRAPHCODE_ZIG0152 test src\App.zig -target x86_64-windows-msvc -lc -luser32 -lgdi32 -ladvapi32 -lole32 -lshell32 -lcomctl32 -I $env:GRAPHCODE_WINGHOSTTY_ROOT\include --test-filter "folder picker completion waits for native callback unwind" -> 1/1 failed: expected 1, found 0
GREEN: $env:GRAPHCODE_ZIG0152 test src\App.zig -target x86_64-windows-msvc -lc -luser32 -lgdi32 -ladvapi32 -lole32 -lshell32 -lcomctl32 -I $env:GRAPHCODE_WINGHOSTTY_ROOT\include --test-filter "folder picker completion waits for native callback unwind" -> 1/1 passed
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task windows-shell -SkipTrayLive -SwiftExecutable $env:GRAPHCODE_SWIFT633 -> exit 0; 52/52 source sections, App 736/736, Worktree Git 21/21, smoke/stress and live UIA passed

The ReleaseSafe development layout also built successfully with pwsh -NoProfile -File Tools\windows\dev.ps1 -Build. The full gate ran from a short session-owned validation worktree because the project worktree exceeds legacy fixture path budgets; its default profile remained unchanged.

Full attended selection through the native picker with physical keyboard input was not executed in this coding-agent session. The focused regression uses a real hidden Win32 window and message queue to reach the proven callback-lifetime transition; the live UIA gate separately verified picker cancellation and unrelated menus/navigation. No Dev Box return bundle, preserved evidence, installed candidate, or release artifact was read or modified.

This fix is sufficient to build a replacement candidate for a fresh D6 rerun. It does not make immutable 0.1.78-beta3 pass.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure