Bound the watcher event channel and full-reload on overflow

[fohara]

Phase D of docs/live-tui-updates.md, and the last open item in
tasks/tasks.live-updates.md.

What was wrong

The watcher's outbound channel was unbounded. A burst large enough to matter (a
git checkout across a branch that touches thousands of task files) queued
thousands of paths for a consumer that drains on a ~100ms tick and reindexes
each one individually. Memory and latency both grew with the size of the burst,
and the per-path work was pointless anyway once the answer became "most of the
project changed".

The fix

The channel is a sync_channel of 256, comfortably above what an editing
session produces and far below what a branch switch does. Past it, the
debouncer stops sending and raises an overflow flag.

WatcherEvents::drain hands the consumer the paths and the flag together, so a
partial path list cannot be mistaken for a complete one. Reading the flag
clears it, so one overflow is reported to one drain. Paths are taken before the
flag: a path dropped in between is still covered by the flag, whereas clearing
first could discard an overflow whose paths were never delivered.

The TUI answers an overflow with Store::handle_watcher_overflow, which emits
StateDelta::FullReload and clears the self-write hash table. That table exists
to recognize the watcher echoing one of our own writes; an echo lost in the
overflow will never arrive, and a stale entry would let a later genuine edit
that reproduces those bytes be mistaken for the echo and dropped.
handle_full_reload reindexes the whole project (still incremental, so
unchanged files are skipped), refreshes the file tree, and restores cursor and
expansion state the same way the single-file path does.

Sends never block. The debouncer thread is also what observes the shutdown
flag, so parking it on a full channel would make drop wait for a consumer that
may itself be waiting on us.

API change

watcher::start returns the receiver rather than taking a Sender, since the
overflow flag has to travel with it. The only caller is the TUI.

Tests

• A burst within capacity does not overflow.
• A burst past capacity fills the channel, delivers what fits, and reports the
  drop.
• An overflow is reported to exactly one drain.
• 200 due paths through a channel of 1 returns rather than deadlocking, which
  is what a blocking send would do.
• Store: overflow asks for a full reload, and forgets pending self-write hashes
  so the same content reads as an external edit afterwards.

Task file cleanup

tasks/tasks.live-updates.md had several items still unchecked that landed in
earlier PRs (Mutation::CreateTask, format_file_in_place using
write_atomic, the stale-modal flag). Those are ticked, and two genuinely
deferred items are marked waived with the reason: the modal R-to-reload key
(Esc-and-retry covers it) and directory-scoped watching (no perf complaint, and
the bounded channel now caps the damage from a large burst).