fix(qa): resolve DF-002 through DF-011 from QA defect tracking sheet

Batch of fixes for defects tracked in "Task Tracking Template.xlsx" (sheet
Defect Management), verified against the sheet's Root Cause/Cach xu ly
columns before this commit:

- DF-002: Co4E node status not reflected after tab switch + missing
  edit-lock on running/done nodes (node_property_panel.py, co4e_runs.py,
  co4e_workflow_crud.py, co4e_canvas_widget.py, co4e_flow_tabs.py,
  canvas_items.py)
- DF-003: hide the run.bat console window unless the app exits with an
  error (run.bat, scripts/console_visibility.ps1 - new)
- DF-004: floating Help Assistant icon covering the Send button after a
  window resize (presentation/shell/main_window.py)
- DF-005: "block network" toggle didn't stop ICMP/raw-socket tools like
  ping (infrastructure/filesystem/command_tools.py,
  security/command_risk_classifier.py)
- DF-006: Monitoring "gay nang khi log lon" - root cause was re-reading
  the ENTIRE audit log history every 3s tick, not missing pagination;
  bounded to a 30-day window (presentation/monitoring/monitoring_tab.py)
  AND added the "So dong/trang" page-size control the ticket also asked
  for (presentation/monitoring/shared/event_table.py,
  shared/filter_scaffold.py, tabs/action_logs_tab.py, tabs/mcp_tab.py,
  tabs/security_events_tab.py, i18n/agents_admin_tab.py)
- DF-007: support choosing a OneDrive/SharePoint folder as a project's
  working directory via Microsoft Graph, downloaded as a local mirror
  with manual sync (core/projects.py, core/ms365_graph.py,
  core/cloud_workspace_sync.py - new, ui/ms365_signin_dialog.py - new,
  ui/cloud_folder_picker_dialog.py - new, i18n/cloud_workspace.py - new,
  ui/workspace_tab.py)
- DF-008: AI-edit instruction box was a fixed-height single-line QLineEdit;
  replaced with an auto-expanding, Enter-to-send/Shift+Enter-newline input
  (presentation/folder/ai_file_editor_dialog.py)
- DF-011: run_command failed with WinError 267 for a project whose
  per-turn output directory had never been created
  (application/conversations/core_runtime_adapter.py)

DF-009 (AI-edit Apply/Discard buttons easy to miss) and DF-010 (AI reply
language - dev-confirmed not a bug) are intentionally NOT part of this
commit: DF-009 has no code fix yet (still "Assigned" in the sheet, only a
UX recommendation was recorded), DF-010 was rejected as expected behavior.

Tests: tests/test_cloud_workspace_sync.py, tests/test_ms365_cloud_dialogs.py,
tests/test_ai_file_editor_input.py, tests/test_monitoring_page_size.py (all
new, all passing). Full suite: 896 passed, 13 known-and-documented failures
unrelated to this change (an existing core/audit_log.py bug, this checkout
not being a git repo before now, and a repo/subprocess folder-naming
mismatch affecting ~66 characterization tests) - see the sheet's DF-006
Evidence column for details.

tests/test_ms365_cloud_dialogs.py

@@ -0,0 +1,77 @@
+"""DF-007 — construction smoke tests for the two new MS365 cloud dialogs.
+Not a full characterization suite (see tests/test_monitoring_tab_container.py
+for the convention this follows) — just proves each dialog builds against a
+real AppConfig/AppContext without touching the network (Graph calls faked via
+monkeypatch)."""
+from __future__ import annotations
+
+import copy
+import os
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+
+QApplication = pytest.importorskip("PySide6.QtWidgets").QApplication
+QDialog = pytest.importorskip("PySide6.QtWidgets").QDialog
+
+from cowork_local.config import AppConfig, DEFAULT_CONFIG
+from cowork_local.core import ms365_auth
+from cowork_local.core import ms365_graph as graph
+from cowork_local.ui.cloud_folder_picker_dialog import CloudFolderPickerDialog
+from cowork_local.ui.ms365_signin_dialog import Ms365SignInDialog, ensure_signed_in
+
+
+@pytest.fixture(scope="module")
+def qapp():
+    app = QApplication.instance() or QApplication([])
+    yield app
+
+
+@pytest.fixture()
+def config(tmp_path):
+    return AppConfig(data=copy.deepcopy(DEFAULT_CONFIG), path=tmp_path / "config.json")
+
+
+def test_signin_dialog_constructs(qapp, config) -> None:
+    dialog = Ms365SignInDialog(config)
+    assert dialog.windowTitle()
+
+
+def test_ensure_signed_in_short_circuits_when_already_signed_in(qapp, config, monkeypatch) -> None:
+    monkeypatch.setattr(ms365_auth, "is_signed_in", lambda cfg: True)
+    assert ensure_signed_in(None, config) is True
+
+
+def test_cloud_folder_picker_constructs_and_lists_onedrive_root(qapp, config, monkeypatch) -> None:
+    monkeypatch.setattr(ms365_auth, "get_access_token", lambda tenant_id, client_id: "fake-token")
+    monkeypatch.setattr(graph, "list_onedrive_files", lambda token, path="": [
+        {"name": "Documents", "folder": {}},
+        {"name": "readme.txt"},
+    ])
+
+    dialog = CloudFolderPickerDialog(config)
+
+    assert dialog._tree.topLevelItemCount() == 2
+    source = dialog.cloud_source()
+    assert source == {"provider": "onedrive", "site_id": "", "site_name": "", "remote_path": ""}
+
+
+def test_cloud_folder_picker_navigates_into_a_folder(qapp, config, monkeypatch) -> None:
+    monkeypatch.setattr(ms365_auth, "get_access_token", lambda tenant_id, client_id: "fake-token")
+
+    def fake_list(token, path=""):
+        if path == "":
+            return [{"name": "Documents", "folder": {}}]
+        if path == "Documents":
+            return [{"name": "report.docx"}]
+        return []
+
+    monkeypatch.setattr(graph, "list_onedrive_files", fake_list)
+
+    dialog = CloudFolderPickerDialog(config)
+    folder_item = dialog._tree.topLevelItem(0)
+    dialog._on_item_activated(folder_item, 0)
+
+    assert dialog._current_remote_path() == "Documents"
+    assert dialog.cloud_source()["remote_path"] == "Documents"