Add File Shelf, a drag-and-drop staging area for files

[havokentity]

Wave 2 Phase A.

Implementation: Add File Shelf, a drag-and-drop staging area for files
Review fixes: File Shelf: make the icon clickable and stop re-drops forking a row

Built by an isolated agent, then adversarially reviewed by an independent agent that checked the branch out and ran swift build + the full suite itself. Every review finding was fixed, with a regression test added for each high and medium.

[havokentity]

@copilot pls do a review

[Copilot]

@copilot pls do a review

Here's the review:

Architecture

The layer separation is solid: FileShelfKit is pure functions over values (testable without AppKit, a status bar, or the user's real shelf), FileShelfStore is the @MainActor shell that owns state and I/O, and the view layer has no business logic. The security-scope lifecycle in reconcileAccess(with:) is correct — scopes are held for the lifetime of an available entry rather than only for the duration of a drag, which is the right call since the receiving app reads the file on its own schedule after the drop completes.

Things done well

• The acceptsFirstMouse fix in commit 2 is the right fix in the right place, and the comment explains the LSUIElement + first-mouse interaction clearly enough that the next person touching this code will understand why it exists.
• Re-resolving the whole shelf before de-duplication in shelve(urls:) is the correct fix for the atomic-save inode problem. The comment in the code traces the full causality chain (atomic save → new inode → stale cached identity → duplicate row).
• describesAFile(_:) correctly distinguishes .missing from .unresolvable via the bookmark's own cached resource values rather than relying on resolution, and the distinction is meaningful to the user ("this will come back" vs. "you have to redo this").
• Real bookmarks in the tests (not a stub resolver) — the rename-survival test actually proves what it claims.
• File permissions: 0o700 on the directory and 0o600 on the shelf file, re-asserted after createDirectory so a directory from an older build doesn't keep a looser mode.

Minor observations

1. DroppedURLCollector has no timeout. If an NSItemProvider never calls its completion (possible in theory for network-backed providers, unlikely for local files), remaining never hits zero and the batch is never shelved. For the current use case (local file URLs), this is a non-issue in practice, but it's worth being aware of.

2. fileURLs(from:) could be private. It's currently internal (accessible via @testable), but the test suite doesn't call it directly — it tests registeredDraggedTypes, acceptsFirstMouse, and the mouse pass-through. Making it private would tighten the surface without breaking anything, though this is stylistic.

3. added count and unresolvable items. Files with nil identity (i.e., those that failed to resolve) always increment added. That means re-dropping a file whose bookmark is genuinely junk will always be counted as a new addition, and the status message will never show "already on the shelf" for it. This is technically correct — two unresolvable entries aren't the same file — and the UX consequence is minor.

Overall the implementation is well-reasoned, the edge cases are handled explicitly rather than silently, and the test coverage directly exercises the promises the tool makes. Nothing blocking.