#118 perf: audit S1–S3 terminal discovery, form pills, trust list skip

Summary

• S1: Replace serial where.exe terminal discovery with in-process PathExecutableLookup (PATH + System32/WindowsPowerShell known locations); keep settings OR for WT/IT and gated WSL.
• S2: Store presentation-ordered pills in WorkspaceEditState and reuse them in form template/data JSON so rebuilds do not rescan GetPills.
• S3: Gate home-row GetStoredWorkspace on WorkspaceTrustFeatures.Enabled (same short-circuit as Run) so trust-off first paint skips per-row clone/lookup.

Stacked on #117 (cursor/home-form-trust-ux) because S3 depends on the trust kill switch.

Test plan

• dotnet test QuickShell.Core.Tests/QuickShell.Core.Tests.csproj -c Release -p:Platform=x64 --filter "FullyQualifiedName~PathExecutableLookup|FullyQualifiedName~TerminalCatalogDiscovery|FullyQualifiedName~SuggestionPillPresentation|FullyQualifiedName~ShortcutFormTemplateJson|FullyQualifiedName~ShortcutListItems|FullyQualifiedName~WorkspaceTrust"
• Cold open CmdPal / Quick Shell: first catalog touch should not spawn where.exe for wt/pwsh/cmd
• Edit a workspace form: suggestion pills still match pill click indices after scan completes
• With trust disabled (ship default): home list subtitles have no Untrusted · prefix
• With trust enabled in tests/override: untrusted rows show Untrusted · again

Made with Cursor

---

Summary by cubic

Speeds up startup and form rendering by replacing where.exe lookups, reusing precomputed form pills, and skipping trust work when the trust UI is off. Adds a shared trust kill switch across Core, Run, and QuickShell.Raycast, plus UX, stability, CodeQL fixes, and a safeguard to keep loaded workspaces if trust‑coercion persistence fails.

• Refactors

  • Terminal discovery: replace where.exe with in-process PathExecutableLookup (PATH + System32/WindowsPowerShell); use it in terminal, agent CLI, and companion app resolution; keep WT/IT and gated WSL.
  • Form pills: precompute in WorkspaceEditState; reuse pills in view and data JSON to avoid a second scan; render only visible slots (4/row); cache templates by visible count; raise WPF chip panel height to 160.
  • Trust features: add WorkspaceTrustFeatures kill switch backed by shared/workspace-trust-features.json (synced into QuickShell.Raycast via pre-scripts); when disabled, skip GetStoredWorkspace, hide trust UI/commands, allow external actions; add createIngressSecurity in QuickShell.Raycast so imported/restored items default safely while enforcement is off.

• Bug Fixes

  • Home favorites: avoid same-thread deadlocks by queuing reload; restore pinned move commands on the home menu.
  • Workspace form: keep “Open in terminal” rows from being demoted, render a read-only-style command field with Clear, honor Cancel/Discard without merging inputs, and tighten companion arguments layout.
  • Trust kill switch: make trust‑coercion persistence best‑effort so I/O or mutex failures don’t clear the in‑memory layout.
  • Address additional CodeQL findings.