Risky behavior now covered

The desktop transcript inbox commits a batch before projecting it into <userData>/transcripts/<threadId>.jsonl. These tests lock the checks that keep a path-like id from becoming a file, a full inbox from dropping unprojected history or wedging forever, and a replay from rewriting a tampered projection.

• Unsafe batch ids (../escape, spaces, slashes, backslashes, non-ASCII, newlines, length 257) and unsafe thread ids (../outside, nested/name, nested\\name, thread.id, .., non-ASCII, NUL, length 257) are rejected with the route sentences before the SQLite inbox or any transcript file is created. A 256-character batch id and batch.name_1:part-2 are accepted, and the projected delivery id is <batchId>:0.
• Idempotency-Key must match batchId. A blank header is ignored. Surrounding spaces are trimmed and then compared. A mismatch writes nothing.
• 10,000 pending receipts fill the inbox. The next batch returns 503 Transcript inbox capacity reached, is not inserted, and creates no transcript file. Pending rows are not evicted.
• 10,000 completed receipts still accept a new batch. The oldest completed receipt is evicted, the new projection is written, and the inbox stays at the cap.
• After a projected line is tampered and the row is reset to pending, the same-id retry returns 409 Idempotency key conflicts with the existing transcript projection. The file stays tampered and is not appended, event_json still has payload text first, and projected stays 0.

Test files added/updated

• Added crates/cowork-server/tests/transcript_inbox_identity_and_capacity.rs

Why these tests materially reduce regression risk

Thread ids are joined onto the transcripts directory, so skipping the charset check can write outside that directory (../outside resolves to <userData>/outside.jsonl). The cap treats pending and completed receipts differently: dropping a pending batch loses unprojected history, and refusing to evict completed batches wedges the inbox after ordinary use. The conflict check is what stops a replay from papering over a changed JSONL line.

No production behavior changes. Main is still a1ce8cd9. This does not duplicate the open coverage PRs #394–#399.

Validation

• cargo test -p cowork-server --test transcript_inbox_identity_and_capacity --test desktop_transcript_batch_receipts --test desktop_state_and_transcript_generations: 17 passed
• cargo clippy -p cowork-server --test transcript_inbox_identity_and_capacity -- -D warnings: clean
• cargo fmt -p cowork-server -- --check: clean
• Full workspace suite not re-run.