Reload the open document when its .comp package changes on disk

[Josusanz]

Closes #103. Follows the requirements you listed there, point by point.

Event-driven, no polling, reload off the main thread. ProjectWatcher listens to the kernel's file system events (DispatchSource.makeFileSystemObjectSource) for the package folder, its manifest.json and its images folder. I went with vnode events instead of NSFilePresenter after checking how writers behave: a presenter is only told about writes that go through NSFileCoordinator, and agents, scripts, git checkout and a fair share of sync clients write plainly, so a presenter never fires for exactly the cases the issue is about. Events are coalesced (300 ms) and the reload goes through ProjectStore.shared.load, the same actor path as an open, so nothing blocks the main thread on big projects.

Only reload on a real change. ProjectDigest hashes the manifest and every asset's bytes. A package that was only touched (metadata rewritten by a sync client, identical bytes saved again) has the same digest and is ignored; there is no reload and no flicker. The digest is remembered after every open, save and reload.

Half-written packages are ignored. If the load fails, the open document is left alone with no message; the next change on disk is checked afresh. A package caught mid-write also fails the digest match against nothing, so it waits too.

Never react to our own saves. The save path sets a flag for its duration and then records the digest of what it wrote, so the watch sees our own package as already known.

Unsaved work is never replaced without asking. A document with unsaved changes gets a sheet, Revert / Keep Mine. Keep Mine remembers the version on disk so it is not asked again until the package changes once more. A hidden tab with unsaved changes is asked when it comes to the front, not while it is out of sight. Edits in progress (brush, transform, sheets) defer the check with a backing-off retry rather than pulling the document out from under them.

No change to the .comp format. The reload installs the snapshot while keeping the viewport, collapsed folders and selection where the layers still exist; undo history starts over, as after an open (it is session-only, per docs/project-format.md).

Tests: ExternalChangeTests covers the digest (touch vs. content), the in-place reload keeping viewport and selection, an external save and an in-place manifest rewrite both reloading, our own save and metadata touches not reloading, a half-written manifest being ignored until it loads, and unsaved work staying put. The full CompositorTests target passes here (Xcode 26.6, macOS 26.5); TiledLayerTests/paintingAtTheLayersEdgeDoesNotChangeIt failed once under the full parallel run and passed in isolation, unrelated to this change.

I have not been able to test against Dropbox from here; happy to adjust anything that shows up in your run.

🤖 Generated with Claude Code

[robbietilton]

Merged, thanks — this is great, and it follows #103 exactly. One change on main: the fingerprint now reads the manifest plus each image's name and size instead of hashing every image's bytes. Every save and open takes a fresh digest, and on a large project reading all the PNGs held each save noticeably. Anything editing a project rewrites the manifest, and a PNG with changed pixels all but always changes size, so it still catches real edits. All your ExternalChangeTests pass with it.