fix(web): distinguish remote workspace navigation targets

[bobleer]

Summary

• make sidebar active-state resolution use stable workspace identity for remote workspaces
• prevent identical POSIX roots on different SSH/container connections from being treated as the same active workspace
• preserve the existing local linked-worktree-to-canonical-project projection
• add a regression test for two remote connections that both open /workspace

Type and Areas

Type: regression fix

Areas: Web UI, remote workspace navigation

Motivation / Impact

Two remote workspaces can legitimately expose the same POSIX root path. The sidebar previously used path equality as an active-state fallback, which marked both rows active. Clicking the folder action on the non-current row then skipped setActiveWorkspace and opened the file view for the previously active remote workspace.

Remote workspaces now match only by stable workspace id; path matching remains local-only for worktree projection.

Verification

• pnpm --dir src/web-ui run test:run src/app/components/NavPanel/sessionNavigationProjection.test.ts src/app/components/NavPanel/sections/workspaces/WorkspaceListSectionLayout.test.ts — 14 tests passed
• pnpm run check:web — passed
• pnpm --dir src/web-ui exec eslint src/app/components/NavPanel/sessionNavigationProjection.ts src/app/components/NavPanel/sections/workspaces/WorkspaceListSection.tsx — passed
• git diff --check — passed

Remote-scenario coverage:

• Remote workspace: exercised the reported identity collision with two remote workspace records using the same /workspace path and different connection/host identities.
• Remote control, Peer Device Mode, and Detached Dispatch: not exercised; this change is limited to sidebar presentation/activation state and does not modify their transport or protocol paths.
• No live SSH target was used; transport behavior is unchanged.

Reviewer Notes

AI-assisted change; fully tested at the focused Web UI level. No persisted shape, Tauri command, remote transport, or user-visible copy changes.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable (not applicable: no copy changes).