Add T-606~T-614 remediation review; ignore editor workspace

Verify at code level that the Phase 1/2 review findings were actually
closed (not just self-reported): icon cache concurrency + LRU + bounded
fetch (T-606), UI-thread icon delivery (T-607), install durability with
Windows FlushFileBuffers / POSIX dir sync (T-613), ZIP central-directory
preflight (T-612), and catalog signature cross-impl vectors (T-614).
All confirmed real. Records three residuals (R1 real power-loss
validation, R2 per-file fsync cost, R3 singleflight ctx caveat).

Also gitignore *.code-workspace (per review recommendation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -30,3 +30,6 @@ gitea.env.*
 # Python 本地校验缓存
 __pycache__/
 *.py[cod]
+
+# 本地编辑器 workspace 配置(个人,不入库)
+*.code-workspace