fix: final pre-PR review sweep

The final holistic + quality audit (three reviewers) returned GO with
four majors; all fixed.

- Start-page recents were the last unguarded writer of the open slot
  on web: clicking one under the open overlay clobbered the in-flight
  open and silently lost its bytes. Refused with the same in-progress
  notice the picker uses.
- The web quit-after-save continuation stalled: a Quit pending now
  survives the tab-save AND continues — offering to save the next
  dirty tab or finishing the quit, mirroring native.
- Data-extraction's multi-file pick is capped (16): every picked file
  becomes a full parsed document held for the session, and one giant
  pick could exhaust the wasm heap.
- The xref registry tests raced each other on the process-global
  registry (reproduced 3/10 at high thread counts — CI roulette); they
  now hold a module-level guard.

Minors: the collision warning is cataloged in all 21 locales; the
docs' parallelism detail header no longer contradicts its own table;
the drop-filter and name-hash helpers gained inline tests (their only
prior coverage was a verbatim copy in the red-team suites).

docs/native-vs-web.md

@@ -76,7 +76,7 @@ shared: native renders the same modals too, so the desktop is effectively
 single-window now. A modal's backdrop dims and blocks clicks but does not
 dismiss; the ✕ button closes it.
 
-### Parallelism — web: single-threaded
+### Parallelism — web: main thread plus one parse/serialize worker
 `wasm32` has no threads without SharedArrayBuffer (which needs COOP/COEP
 headers GitHub Pages can't set). `crate::par::prelude` re-exports `rayon` on
 native and sequential `std` iterators on wasm, so the same call sites run in