fix(app): resolve sandbox project edits

[Brendonovich]

Summary

• Match project metadata by project ID, worktree, or sandbox membership before edit actions decide whether to call project.update
• Share lookup between global and layout project enrichment paths
• Add regression coverage for sandbox directories

Testing

• bun test src/context/global-sync/utils.test.ts
• bun typecheck
• bun turbo typecheck (push hook)

[andrei-hasna]

Automated merge review for task 289f9b30-c127-4aad-8b12-17e6f2969596:

• PR is open/non-draft; GitHub reports mergeStateStatus=CLEAN, mergeable=MERGEABLE, and all 10 listed checks passing on PR head ec19f731.
• Branch freshness: current origin/dev is dfeb1b505; PR head is ec19f731 and is 1 commit ahead / 4 commits behind current origin/dev.
• Current-base merge validation: isolated worktree at /tmp/opencode-pr34253-w5PXu0 from origin/dev=dfeb1b505; git merge --no-ff --no-commit origin/project-edit-update succeeded with no conflicts.
• Focused validation passed on the current-base merge after bun install in the isolated worktree:
  • bun test --preload ./happydom.ts ./src/context/global-sync/utils.test.ts in packages/app: 8 tests passed, 0 failed.
  • bun run typecheck in packages/app: passed.
  • git diff --check --cached: passed.
  • ./node_modules/.bin/oxlint packages/app/src/context/global-sync/utils.test.ts packages/app/src/context/global-sync/utils.ts packages/app/src/context/global.tsx packages/app/src/context/layout.tsx: 0 errors; 10 existing warnings in touched files.
• Adversarial review found no P0/P1 blockers. Residual P3 risk: findProjectMetadata uses raw worktree/sandboxes string equality; normalized path variant coverage would reduce risk if non-canonical paths can reach this helper.
• Merge blocker: authenticated runner account andrei-hasna has pull=true and push=false on anomalyco/opencode, so this workflow cannot perform the merge. A push/maintain-capable runner should merge if policy still allows and base has not moved again.

[andrei-hasna]

Automated merge review update for todos task 141b1ac2-e893-45b7-a6e7-3b12893d45fa:

• PR is open/non-draft; GitHub reports mergeStateStatus=CLEAN, mergeable=MERGEABLE, and all 10 listed checks passing on PR head ec19f7319575e1db7c1300091ea4b0a5451e8234.
• Current base moved during review; latest fetched origin/dev is 58ba99e505a8c898f79e1438bddea35c197bc0af (fix(desktop): avoid destroyed window permission checks (#34300)). PR is now 1 commit ahead / 6 commits behind current dev.
• Refreshed current-base merge validation in isolated worktree /home/hasna/.hasna/loops/worktrees/community-opencode/141b1ac2-e893-45b7-a6e7-3b12893d45fa-ad5fd840: git merge --no-ff --no-commit origin/pr/34253 on origin/dev=58ba99e50 succeeded with no conflicts.
• Focused local validation passed on the refreshed merge candidate:
  • git diff --cached --check: passed.
  • bun test --preload ./happydom.ts ./src/context/global-sync/utils.test.ts from packages/app: 8 pass, 0 fail.
  • bun typecheck from packages/app: passed (tsgo -b).
  • bunx oxlint packages/app/src/context/global-sync/utils.test.ts packages/app/src/context/global-sync/utils.ts packages/app/src/context/global.tsx packages/app/src/context/layout.tsx: 0 errors; 10 existing warnings in touched files.
• Adversarial reviewer approved twice. After the base moved to 58ba99e50, reviewer found no blockers and noted the new base change is isolated to packages/desktop/src/main/windows.ts.

Merge blocker: this runner is authenticated as andrei-hasna, and GitHub reports repository permissions pull=true, push=false for anomalyco/opencode. I cannot merge this PR from this workflow. A push/maintain-capable runner can merge if the base/head state above is still current or after re-running the same checks if dev moves again.