Summary

Two rewind-correctness fixes from issue triage.

1. Conversation rewind silently no-ops after compaction (#3598)

A turn's conversation-rewind boundary is the message-log index recorded at turn start. Compaction shrinks Session.Messages without rewriting checkpoint boundaries, so once a turn has been compacted away its boundary exceeds len(Messages). Controller.Rewind tested boundary <= len(s.Messages) and, when that was false, skipped the truncation but still emitted a "rewound conversation to turn N" success notice. For RewindBoth the code was rolled back while the conversation silently was not — the data-loss in #3598 ("code rolled back but conversation is not").

Now it returns a clear conversation rewind unavailable … the conversation was compacted past this point failure (surfaced as a Warn notice via the existing rewindFail path) and only reports success when the log was actually truncated.

2. CanCode ignores later turns' file changes (#3438)

RestoreCode(turn) reverts every file touched in that turn or any later one, so a turn that changed no files of its own can still rewind code when a later turn did. The desktop CanCode flag only checked the turn's own Paths, disabling the code/both buttons for such turns. It now propagates backwards over the oldest-first checkpoint list so the UI matches backend capability.

Note: this addresses the CanCode sub-bug called out in #3438. The broader frontend turn-number divergence in #3438/#3640 (synthetic user messages from stream-recovery/retries/plan-approval shift the frontend turn counter relative to backend checkpoint turns) is a separate, larger fix that needs end-to-end desktop verification and is tracked separately.

Test plan (end-to-end)

• internal/control/rewind_e2e_test.go — drives two real turns through a real agent + controller + checkpoint store, simulates compaction by shrinking the log below the recorded boundary, and asserts RewindBoth now returns a compacted-past failure, emits no false success notice, and leaves the log intact; companion test asserts a live boundary still truncates + reports success.
• desktop/checkpoints_cancode_test.go — seeds a real checkpoint store (turn 0 no files, turn 1 with a file, turn 2 no files) and asserts CheckpointsForTab returns CanCode [true, true, false].
• go test ./internal/control ./internal/checkpoint green; go vet + gofmt clean on changed files. (Two pre-existing desktop failures on Windows — TestMediaTokenHandlerEscapedFilename, TestAddSkillPathRestoresConventionRootWithoutCustomPath — reproduce without this change and are platform/env-specific.)