fix(host): cancellable listing scans and O(log window) insertion

capability.list gains an optional AbortSignal threaded from the RPC
carrier's request signal (the pickDirectory pattern): a disconnected or
timed-out caller stops the opendir loop instead of the scan outliving
its caller, and the abort surfaces as its own reason rather than a
directory-unreadable dressing. boundedInsert rejects a full window's
at-or-beyond-tail candidate on one comparison and binary-inserts
retained candidates, so an oversized level no longer pays a window scan
per dirent.

packages/host/apiproxy/src/api/host.ts

@@ -62,10 +62,13 @@ export interface HostApi {
   /**
    * List one directory level for the in-app browser; an absent path lists the
    * host account's home directory. Only served under the `browse` capability;
-   * unreadable or missing targets fail with `directory-unreadable`.
+   * unreadable or missing targets fail with `directory-unreadable`. The
+   * carrier's request signal follows the caller, stopping the backend's scan
+   * on disconnect or timeout.
    */
   listDirectory(
     request: RpcRequest<{ path?: string }>,
+    signal: AbortSignal,
   ): Promise<RpcResponse<DirectoryListing>>
 
   /**