fix: bound what the Files panel walk reads and keep its subfolders in it (release review)

The round-robin walk capped what it listed, not what it read: every queued
folder was read whole, sorted and held until drained, so one GET could pull
millions of entries (100 folders of 50,000 files killed a 400 MB heap). A read
now keeps only the entries the listing can use, and MAX_WALK_ENTRIES_READ stops
opening folders at 250,000 entries, leaving the rest queued and flagged.

A folder also spent its whole share on its own files, leaving nothing for the
subfolders it had just found, alone in its round or beside a sibling, so search
hits inside them were lost. Its files now count as one more share beside those
subfolders. Math.max(directoriesInRound, 2) would have fixed only the sole-folder
case and cut a wide root's folder list short.

Folders below the walk root are probed before their readdir (#516), since the
walk reaches folders the depth-first one never did.

Filtering at the read also clears the false flag on a folder whose only unread
entries were hidden or excluded, and an exactly-full workspace now finishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api-reference.md

@@ -1014,13 +1014,20 @@ while a `q` containing `/` is matched against paths relative to the folder walke
 also carries `worktree`, the same `{ name, path }`, whenever the session has a `liveWorktree`,
 whichever folder was walked and with or without `root=live`.
 
-The walk reads at most 5,000 files and folders and sets `truncated` when it stops early. It is
-a per-directory round-robin (breadth-first): each folder found so far gets an equal share of what
-is left before any of them gets more, so one huge folder cannot hide its later siblings, and the
-`matches` of a `q` search come back shallow-first. A folder made of thousands of small subfolders
-can still use most of the limit one level down. In the tree, a directory node the limit stopped
-short of also carries `incomplete: true`: its `children` hold what was read before the limit,
-which can be nothing. The key is absent on every other node.
+The walk lists at most 5,000 files and folders and opens no more folders once it has read 250,000
+directory entries (the folder that crosses that line is read whole). It sets `truncated` when it
+stops with anything left, which includes a folder it never opened, even if that folder would have
+turned out to be empty. It is a per-directory round-robin (breadth-first): each folder found so far
+gets an equal share of what is left before any of them gets more, and a folder's own files count
+as one more share beside the subfolders it has just found, so one huge folder cannot use up the
+listing limit before its later siblings or its own subfolders are read, and the `matches` of a `q`
+search come back shallow-first. A folder made of thousands of small subfolders can still use most
+of the limit one level down, and folders that add up to the read limit can leave later ones
+unread. In the tree, a directory node either limit stopped short of also carries
+`incomplete: true`: its `children` hold what was listed before the limit, which can be nothing.
+The key is absent on every other node. A folder below the start of the walk that does not answer a
+bounded probe (a mount that stopped responding) is skipped like an unreadable one: it is listed
+with empty `children` and no `incomplete`.
 
 ## Session model (`displayModel`)