fix(gui): open waveform paths across platforms

[Luyoung0001]

Context

This is remediation 6 of 6 extracted from the code review follow-up in #182. It addresses cross-platform waveform opening and trust-boundary issues found during review of f5e9af0f536878f804ef51887e5f5ab734388a24.

Finding

The renderer manually converted local paths to file:// URLs before opening waveforms. That conversion can corrupt native Windows paths such as C:\work\cpu\trace.vcd, and it delegated local-file opening through a broad URL-oriented path.

Changes

• Add a narrow workspace-scoped openWaveformExternal desktop API.
• Reuse Surfer project-scope, extension, canonical-path, and regular-file validation.
• Open the validated native path with Electron shell.openPath.
• Return operating-system open errors through the IPC result contract.
• Remove renderer-side local path to URL conversion.
• Add coverage for raw Windows paths, preload exposure, OS errors, and renderer API usage.

Result

Waveform files are opened with their native platform paths only after workspace-scoped validation. Windows paths remain intact, and arbitrary local files cannot be opened through this API.

Verification

• Cherry-picked independently onto the latest main.
• Resolved test-context conflicts without importing remediations 1 or 3.
• Complete pnpm run check passed on this single-fix branch.
• The waveform Open action was manually verified before submission.

Review lineage

• Combined review follow-up: fix(gui): address six frontend workflow code review findings #182
• Original remediation commit: 2b104eb
• Independent branch commit: 8222b52

[Emin017]

Reviewed at 8222b52. No blocking findings. The renderer now passes native paths unchanged through a narrow workspace channel; the main process reuses project-scope, canonical-path, extension, and regular-file validation before calling shell.openPath, and non-empty OS errors propagate through the IPC error contract. Verified the affected desktop, preload, Surfer, and renderer tests (83 tests), both desktop and renderer typechecks, and git diff --check.

[Emin017]

Re-reviewed at 238b145 after merging main. No blocking findings. The only merge conflict was in the registerIpc test mock list, and the resolution correctly retained both openPath from this PR and showMessageBox from main. The new external-read approval model still feeds waveform opening through the same window-scoped requestProjectPathAccess boundary. Verified 104 focused tests, desktop and renderer typechecks, git diff --check, and successful GUI, Windows, and macOS CI jobs. The unrelated AppImage packaging job was still running when this review was submitted.