Render raw thread IDs as mention pills

[brsbl]

Summary

• Render known raw thr_ IDs as linked thread mention pills in user, agent, generated, and side-chat message content.
• Convert inline-code spans only when the entire span is one resolvable raw thread ID; preserve mixed inline code, fenced code, and authored link-label code.
• Render known raw IDs as non-interactive mention pills in thread titles.
• Preserve unresolved and path-adjacent IDs as literal text.
• Resolve IDs through a shared, bounded batch lookup and cache, using the resolved thread's project for navigation.
• Keep generated-message previews bounded and prevent ordinary agent content from loading remote image or Mermaid subresources.

Verification

• Focused app tests: 56 passed.
• Domain, server-contract, SDK, database, and server resolver tests: 59 passed.
• App Turbo typecheck passed.
• Focused lint and formatting checks passed.
• Multi-agent review loop completed with no remaining P0-P2 findings before the inline-code follow-up.
• Built and launched this PR worktree with scripts/bb-dev-app current --desktop.
• In the PR-built Electron app, verified an unlinked title pill plus linked message pills for both prose and an exact inline-code thread ID.

[SawyerHood]

🚨 SLOP COP 🚨 · review

I am SlopCop. I started this review under the review rule.

I will check security, code quality, performance, architecture, and the user path.

[SawyerHood]

🚨 SLOP COP 🚨 · review

ELI5: This change turns a thread ID into a name tag and a link. It is like putting a clear label on a toy box. The main idea works. Some labels can open the wrong box or make the app do too much work.

Findings

1. High — Unbounded thread lookups. Each unknown raw ID creates one GET request and one real-time subscription. A long message can create thousands.
2. Medium — Remote image requests. Regular generated agent text now uses Markdown. A visible preview can load a remote image before the user expands it.
3. Medium — Unlimited preview work. The first preview line has no limit. A 500 KiB synthetic line took about 482 ms to parse.
4. Medium — Wrong project links. A cross-project thread resource can receive a route for the current timeline project.
5. Medium — Path suffix matches. A path such as /tmp/thr_dcwivn5n8w can become a pill and start a request.
6. Medium — Duplicate ID contract. The UI copies the database grammar. It also excludes valid rows that use the older NanoID format.

The new query path needs a bounded batch resolver. The ID grammar also needs one shared contract. These changes remove duplicate policy and control network work.

Checks

• The full app suite passed with 2,509 tests across 332 files.
• The Turbo app type check passed.
• git diff --check origin/main...HEAD passed.
• The User Message story showed one linked pill and one literal code token.
• The Split Workspace story showed correct title and message pills.
• The browser showed no visible clipping or layout error.
• The security, quality, performance, and architecture reviews found no XSS or unsafe regular expression.

The GPT-5.6 review gate returned REQUEST CHANGES. I used the GitHub comment action only.