fix(rewind): stop blocking undo on unrecognized tools (#1192)

restoreAvailable conflated two questions: whether the files this checkpoint
reports can be put back, and whether the checkpoint saw every file the turn
touched. Any tool outside an 18-name allowlist — Bash, PowerShell, TaskCreate,
every MCP tool — forced the second to false, and one such call anywhere from
the target turn onward disabled undo for the whole range. In practice that is
every real turn, so v0.5.3 shipped with undo effectively dead.

Split the two. restoreAvailable now answers only the first question.
The second becomes unverifiedChangeSources: tool names whose file effects the
checkpoint could not capture. Undo stays available and restores exactly the
files it lists, and the card, the confirmation, and the completion toast each
name what it is leaving behind. An unrecognized tool now costs a warning
instead of the feature. A transcript that cannot be read still blocks, because
then even the reported file list may be wrong.

Bash calls are classified against the existing read-only allowlist via a new
recordedCommandIsReadOnly, which drops the sandbox/cwd checks that describe the
live process rather than the replayed session. `git status` no longer warns at
all, so the warning means something when it appears.

Rewind also takes a mode. `conversation` skips the file restore entirely, so a
turn whose files cannot be restored no longer costs the user the ability to
back out of the prompt — matching how upstream keeps Restore conversation
independent of Restore code.

Files written by shell commands were never recoverable here; the checkpoint
only ever covered the structured file tools. Reporting that is honest, and
docs now say so.

docs/desktop/sessions.md

@@ -69,7 +69,11 @@ Claude 每完成一轮，对话里会出现一张「{n} 个文件已更改」的
 - **撤销当前轮次** — 回滚最近一次回复，并把这一轮改过的文件恢复回去。
 - **回滚到这一轮之前** — 对历史轮次用，把会话和文件一起退回那个检查点。
 
-点了会先弹确认框。有些轮次没有可用的文件检查点，这时只回滚对话，不动文件——提示语里会说清楚。
+点了会先弹确认框，里面可以选**代码和对话一起回滚**，还是**只回滚对话**（保留磁盘上的文件不动）。
+
+检查点记录的是 Claude 通过编辑工具（Read/Edit/Write 那一类）改过的文件。**Shell 命令写出去的文件不在检查点里**：`npm install`、`rm`、重定向到文件的命令，撤销都还原不了。遇到这种轮次，卡片和确认框会点名是哪些工具没被记录，撤销照常可用，但只还原它列出的那些文件。需要兜底就用 git。
+
+如果某一轮的文件检查点本身残缺（会话记录损坏、路径不安全等），代码就还原不了了，确认框里只剩「只回滚对话」——对话永远能退回去。
 
 ## 活动面板：它现在在忙什么
 

docs/en/desktop/sessions.md

@@ -69,7 +69,11 @@ After each turn, a card appears in the conversation reading "**{n} files changed
 - **Undo current turn** — roll back the latest reply and restore the files it changed.
 - **Roll back to before this turn** — for older turns: rewind both the conversation and the files to that checkpoint.
 
-Both ask for confirmation first. Some turns have no file checkpoint; in that case only the conversation rolls back, and the message says so.
+Both ask for confirmation first, where you choose between rolling back **code and conversation together** or **the conversation only** (leaving the files on disk untouched).
+
+Checkpoints capture the files Claude changed through its editing tools. **Files written by shell commands are not checkpointed** — `npm install`, `rm`, or a command redirecting into a file cannot be undone. On such a turn the card and the confirmation name the tools that went unrecorded; undo still works, but it only restores the files it lists. Use git for anything you need a guaranteed way back from.
+
+When a turn's file checkpoint is itself incomplete (a damaged session log, an unsafe path), the code cannot be restored and the confirmation offers only **Roll back conversation only** — the conversation can always be rewound.
 
 ## The Activity panel