feat(ui): interactive open — native dialog + drag-drop (ejected runner)

[sepehr-safari]

Summary

Add interactive trace opening — a native Open dialog and drag-and-drop of
trace files onto the window — so users aren't limited to command-line path args
(#27) for loading traces.

Why this is deferred (not S3)

The zero-config UiApp (Model / Msg / update / view) exposes no path to the
platform's showOpenDialog or to file-drop routing: the effects channel has no
dialog op, there is no on_file_drop widget handler, and RunOptions offers only
menus / shortcuts. The capabilities exist at the platform/runtime layer
(PlatformServices.showOpenDialog, CanvasWidgetFileDropEvent, the file_drops
capability) but reaching them requires ejecting the build to own a custom
runner. That is a standing architectural change (owning the build graph and
runtime wiring from here on), so it deserves its own issue and an ADR rather than
being smuggled into the S3 UI milestone.

Scope (when scheduled)

• Eject decision + ADR — evaluate ejecting the zero-config build vs. a
  narrower seam; record the decision and its maintenance cost as an ADR.
• Custom runner — wire showOpenDialog (macOS NSOpenPanel / GTK) behind a
  "File → Open" menu item + shortcut, and route CanvasWidgetFileDropEvent (with
  splitDropPaths) into a load Msg. Reuse the feat(ui): inspector shell — workspace model + trace loading #27 workspace load path.
• Reading opened files — the effects-channel readFile caps at 1 MiB, so the
  large-file read must go through the same unbounded seam main uses for CLI
  args, driven from the runner.

Acceptance criteria (when scheduled)

• A native Open dialog loads a trace into the workspace.
• Dropping trace file(s) onto the window opens them.
• Large (100 MB) files open through the dialog/drop path, not just via CLI.
• Eject/runner decision captured as an ADR; CI stays green on both platforms.

Dependencies

Depends on #27 (workspace load path). Deferred — not part of S3; schedule
into a later milestone once the inspector core has shipped and proven the model.

[sepehr-safari]

Discovered while building the message inspector (#30): the session panel's jump-to-first-event can select and highlight a row, but it cannot scroll the timeline's virtual list to reveal that row. The zero-config UiApp exposes no model-driven scroll control — the runtime owns the virtual list's scroll offset (keyed by list id), observable via on_scroll but not settable. So programmatic reveal timeline row N belongs to this same runner-eject work, alongside the native open dialog and drag-drop. Worth an explicit ui.virtualList scroll-target (or a reveal effect) when the runner is ejected.