Performance and reliability pass

This release is focused on performance and reliability: faster, race-free client-server interactions, more accurate resource semantics, and a hardened port-forward manager.

✨ Features

• Loading spinners on resource-list empty states
• macOS blue accent as the new default UI theme color
• PDB-blocked drain outcomes now surfaced as a distinct Blocked flag

🚀 Performance

• Namespace fan-out for list/watch calls is now parallelized — a single-namespace error no longer blocks the whole scope
• Raised client QPS/Burst limits and set a proper User-Agent on the Kubernetes REST config
• Discovery cache lookup is now shared between LIST and watch fan-outs
• Stripped managedFields before sending resources over the bridge, with a lazy fetch for "Show managed fields"
• Cached accessor reads in Gateway API ports/routes/listener cells instead of recomputing per render

🐛 Fixes

• Port-forward manager hardening: serialized per-id lifecycle ops, idempotent startup/reload, atomic config swap, cancelled job context on terminal exits, validated bind address, parked (not dropped) failed restarts, cleared stale local ports
• Preserved watch event ordering by serializing batch flushes
• Fixed a check-then-act race when closing the singleton utility window
• Stopped watching a GVR on contexts that don't actually serve it; kept stale-version warnings alive through the LIST pre-filter
• RBAC permission merging no longer collapses grants with different apiGroups or resourceNames
• Pods: correctly count native sidecars in CPU/memory totals and host ports; stopped reporting Completed while another container is still running or has failed
• Nodes: preserved numeric YAML scalars (host ports, affinity selectors) through the scheduling simulator
• Namespaces: read the kubernetes finalizer from spec.finalizers; deduped finalizers correctly
• CronJobs: correctly parse stepped cron values (N/step → N-max/step)
• Gateway API: condition rollups now name the correct source condition
• Fixed an "Unknown resource type" flash before discovery settles, and surfaced discovery errors instead of an endless "Discovering…" state
• Guarded URL decoding against a crash on malformed routes
• Browser.OpenURL is now awaited so the web fallback reliably fires
• Reset tab-drag state when the source tab is deleted mid-drag

🧹 Misc / Chore

• Reorganized resource modules: moved shared workload/gateway/event helpers into generic shared/ packages, removed re-export shims, folded flat Gateway API files into shared/gateway/
• Migrated legacy confirm contexts to createConfirmCommandContext
• Routed external-link opening and browser calls through the lib/browser platform seam
• Extracted forEachBounded worker-pool helper and coerceMetaStringMaps for annotation/label coercion
• Added test coverage for tab-drag reset, namespace fan-out partial failure, and the ListResources pre-filter
• Documented the lock-free reporter-slice invariant and the CRD-installed-mid-watch trade-off