fix: avoid idle workspace re-renders from activity and label churn

[kalvinnchau]

Summary

• Subscribe the workspace to a stable working-channel projection, preserving expiry on the existing activity timer.
• Stabilize composer send and unchanged DM labels/session child arrays across unrelated updates.

Validation

• Full frontend Vitest: 2,410 passed (227 files); Biome, TypeScript, and frontend build passed at the same code tree before the metadata-only amend.
• Pre-push at 4055b1d: TypeScript, 863 related tests, and design-system guards passed (BUZZ_TEST_WORKERS=2).
• In the S1 trace, the 58–75 s quiet window had zero workspace/sidebar/composer/row renders despite activity updates. During 39–58 s, 20 sidebar renders corresponded to actual preview changes. The 201 row renders during that burst are out of scope (batch 2). This is not a controlled before/after benchmark.

Remaining checks

• Default-worker runs previously hit unrelated relay/read-state timeouts; bounded-worker full-suite runs passed. No fresh browser/native journey after the metadata-only amend.
• No browser cases were added or removed.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No blocking findings at 4055b1ddc7cd1809aa9df3028323d391b13333aa against base/merge-base a47ddaf452e605a59056476d2091146e1f3902e8.

Reviewed the working-channel projection through expiry, disconnect, access/cache reset and disposal; DM-label and child-session identity invalidation; and composer send/reveal/navigation behavior. Independent activity and UI review lanes returned no concrete defects. The change keeps the existing activity timer and authority boundaries, and cache reuse remains conditional on unchanged source identity and resolved values.

Hosted checks passed, including CI required, all Chromium/WebKit shards and DCO; Windows native validation was skipped. Review validation was source/diff/test inspection, not a fresh local test run or app launch. The PR’s S1 trace is useful observational evidence, not a controlled before/after benchmark. Direct regression assertions for child-array identity and working-subscriber reset notifications would strengthen coverage, but no failing behavior was established. This is a comment review, not approval or merge authorization.