fix: harden import recovery and utility cancellation

[DeusExTaco]

Summary

• Reduce SQLite write contention during recovery and recover mixed-folder files using verified per-file identities without changing source files.
• Publish managed imports safely on NAS filesystems that support exclusive rename but not hard links, retaining no-overwrite collision protection.
• Make utility cancellation idempotent, stop new batch work, interrupt disposable conversion stages safely, and recover stuck cancelling jobs on startup without losing completed work or rollback history.

Validation

• make ci-full passed: 12,022 application tests, 91.16% coverage, 25 accessibility tests, 575 browser tests each in Chromium and Firefox, and 7 production-image smoke tests.
• Workflow hygiene, secret scans, dependency checks, strict typing, migrations, container runtime hardening, and the Grype High-severity gate passed.
• Exercised startup recovery against a disposable diagnostic database copy: all 36 completed and 12 pending item records were preserved while the stuck job and activity became cancelled.

Safety

• File replacement finishes at its safe boundary before cancellation releases the worker slot; cancellation does not undo completed conversions.
• No schema migration, acceptance-lab changes, or new security exceptions.
• Existing import matching and source-preservation safeguards remain in place.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T02:21:33.861410Z	6c08ffa	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[DeusExTaco]

The PR checks passed and the merge completed, but fresh validation of the exact develop commit exposed a timing-dependent shared-connection test-fixture issue. Edge has not been published. Test-only follow-up #155 replaces the queue fixture with independent SQLite connections, commits setup explicitly, and adds a regression proving that closing a status reader cannot roll back a pending write in another session. All 94 queue/cancellation tests pass locally; publication will wait for the complete gates on the follow-up.

[DeusExTaco]

Edge is published from develop commit d965657, including the test-isolation follow-up in #155. All exact-commit release gates passed. Both GHCR and Docker Hub serve version 1.3.1-dev for linux/amd64 and linux/arm64 at sha256:c8bdeaf40291335427246224bdb11902568a7432f86e4c82c214ede39562186d. Both platform revision labels match the validated commit, image signing and verification passed, and production latest remains unchanged. Release workflow: https://github.com/pullboxapp/pullbox/actions/runs/35419313435 . The existing Firefox story-arc checkbox setup test required a rerun; its failure artifacts were preserved and no assertions were weakened.