Adds the dialog plugin and an actor that owns the list of repositories opened before, persisted under the platform's config directory. A separate actor rather than part of the workspace: the workspace owns repositories that are open, this owns a memory of ones that were, and the two have different lifetimes. It owns both the list and the file, so neither needs a lock. Reads and writes go through tokio::fs, since the actor is async and blocking it would stall every other request. The workspace records on a successful open rather than the command layer doing it, because remembering is part of opening and commands are meant to be free of decisions like that. A failed open records nothing, and a failed write never fails the open — not remembering a repository is a far smaller problem than refusing to open one over it. Writes that do fail say so on stderr rather than vanishing. Entries are keyed by repository id, so opening the same repository again moves it to the front instead of appearing twice. The path stored is the working tree rather than the git directory, because that is what a person recognises. A repository that has since been moved or deleted is flagged rather than dropped: the user may want to see it was there and forget it deliberately. That flag is recomputed on every read and never trusted from disk. An unreadable file is treated as an empty list. Refusing to start because a convenience cache got mangled would be the wrong trade. The capability grants dialog:allow-open only — opening a folder, not saving files or showing message dialogs. Twelve tests cover ordering, deduplication, the twenty-entry cap, forgetting something unknown, surviving a restart, a repository that disappears, a corrupt file, and the wire shape. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>