[wieslawsoltes]

WebScene's existing v1 file service moves whole file bytes and cannot represent native open-directory/save-panel options or durable host-owned access grants. Code OSS needs a bounded transport between browser-facing picker APIs and AppScene native panels without exposing filesystem paths or platform bookmark objects to JavaScript.

This adds an independent v2 file-panel request/result ABI and broker for open-file, open-directory, and save-file operations. Requests carry bounded UTF-8 presentation metadata, filters, options, selection limits, and an opaque initial-location token. Results distinguish success, cancellation, denial, and error and return only bounded display metadata plus opaque grant identifiers. The broker enforces exact request IDs, exactly-once completion, reentrant callbacks, a 16-request bound, strict capability and shape validation, and retirement on navigation, startup replacement, shutdown, and terminal runtime failure. The v1 service and its bytes remain unchanged.

This is the bottom PR in the #248 stack. Dependent PR #294 adds the browser picker producers and opaque handles. Native panels, security-scoped grants/bookmarks, and filesystem authority remain in SceneTech/AppScene#123.

Validation on exact merged main 1bd8596e:

• full V8 native dylib rebuild
• focused file-panel contract and dependent picker lifecycle gates pass
• ASan/UBSan file-panel contract pass
• C11 public-header compile
• Node export allowlist and actual dylib nm verify all three v2 exports
• 10,000 broker cycles in 0.011 seconds
• 10,007 completions, 16 retirements, zero retained broker bytes
• reentrant, malformed, oversized, duplicate, stale-retirement, callback-failure, and all four result-status paths covered

Cumulative validation and #292 replay evidence are recorded in dependent PR #294. Advances #248.