[chuks-qua]

What

Closes #2234.

Before this change, a provider switch left no trace in the timeline, and the thread kept one provider icon.

Now a switched thread shows the following:

• A marker. "Claude → Codex" appears between the switching prompt and the first reply from the new provider, with both provider icons. It names the switch and nothing else.
• A stacked sidebar icon. The thread row in the project tree stacks the current provider in front of the previous one, inside the same 16px slot, so titles stay aligned.

A thread that never switched renders exactly as before.

commitProviderSwitch (one transaction)
  threads.providers_used   [claude] -> [claude, codex]   least recently used first
  messages (role: system)  "Switched from Claude to Codex" + provider_switch {from, to, handoffId}
broadcast
  thread.providerSwitched  patches the row, appends the marker once
  thread.modelUpdated      unchanged, for older clients

The marker's sequence is reserved when the switch is armed, so it stays before the reply even when the save lands after the reply was accepted. The handoff audit is still written to disk under the id the marker carries, for debugging.

Verified live in Electron with a real Claude Haiku turn followed by a GPT-6 Astra turn in .dev/fixture-repo. The marker reads "Claude→Codex" and the thread row stacks both icons. A thread switched on the base build, which has no providers_used, still shows no marker and one icon. Targeted tests pass: the server handoff and switch suites at 104 of 104, the web conversation and store suites at 1405 of 1405, and shared at 162 of 162, with bun run typecheck at 10 of 10 tasks.

Why

When a user moves a running thread from one provider to another, they need to see where the switch happened. Without that, a reply from Codex reads as if Claude wrote it. The sidebar stack lets users spot mixed-provider threads without opening them.

UI Changes

Before: a Claude to Codex switch on main. There is no marker, replies carry no provider, and the sidebar shows one icon.

After: the same flow on this branch, with the marker and the stacked sidebar icon.

Review Notes

• Database migration. 0096 adds two nullable columns: messages.provider_switch and threads.providers_used. Stable and nightly builds share the database. The marker is a plain role: "system" message rather than a new systemNotice kind because older builds parse systemNotice strictly. Older builds show the marker as plain text and ignore both columns.
• Security. Handoff paths are hardened. A thread id now goes through validateThreadId, which rejects any .., and a handoff directory name must be a ULID. Tests cover traversal attempts.
• No backfill. Switches made before this change have no marker and no providers_used.
• Known gaps for follow-up.
  • The picker still can't start a switch on an existing thread. That is PSW-03 (feat(PSW-03): model picker offers a provider switch on a started thread #2233). This PR was verified by sending a provider-switching agent.send.
  • The marker has not been checked in a narrow pane.