fix: close the review findings on the restore-all/deep-links/PWA wave

Two reviewers, no blockers, three majors — all fixed.

- The remembered-tab focus after a Restore-all batch fired at the
  message boundary, but the LAST restore's tab inserts one async round
  later (its OPFS recent-cache write precedes the insertion) and the
  insertion's own activation overwrote the selection. The focus flag
  now also consumes at the insertion point, so the batch focus holds
  in the common all-success case.
- The service worker cached ANY successful in-scope navigation under
  the shell key — a direct navigation to a font or JSON would be
  served as the app shell for every offline navigation until the next
  online visit. Only the scope root caches as the shell now.
- Local macOS builds broke: sha256sum does not exist there (shasum
  does) and BSD sed requires an explicit -i suffix. The wrapper picks
  the available hasher and uses a portable in-place edit.

Also: '/app/' gets its own web app manifest (the previous commit's
'installable' claim was true only of the marketing site, whose
start_url sits OUTSIDE the service worker's scope — an installed app
opened offline showed an error page). The README now states the
honest offline timing (assets captured on the second visit — the
first visit's preloads outrun the installing worker) and the
long-lived-window update behavior.

README.md

@@ -183,7 +183,7 @@ never go missing from the bundle):
 sh scripts/build-web.sh
 ```
 
-The bundle ships a service worker (`web/sw.js`, deployed at `/app/sw.js`) that caches the app shell: after one online visit the app starts fully offline and the ~55 MB wasm bundle is served from the browser cache instead of re-downloaded. `build-web.sh` stamps a hash of the finished bundle into `sw.js` as the cache version, so every deploy ships a fresh cache and stale ones are cleaned up automatically.
+The bundle ships a service worker (`web/sw.js`, deployed at `/app/sw.js`) that caches the app shell: after a first online visit registers it, the assets are captured on the following visit and the app then starts fully offline, the ~55 MB wasm bundle served from the browser cache instead of re-downloaded. A long-lived installed window keeps running its current version until all its tabs close (no mid-session disruption); the next launch picks up the update. `build-web.sh` stamps a hash of the finished bundle into `sw.js` as the cache version, so every deploy ships a fresh cache and stale ones are cleaned up automatically. `/app/` carries its own web app manifest, so the editor itself can be installed as a standalone app.
 
 ## Automation