✨ feat(vscode): 多人协作二期:状态分层/写校验/签名/团队视图

- 本机状态(会话id/worktree/profile/prDiffFile)迁 workspaceState,
  共享 state JSON 只留团队字段;读侧本地记录叠加,旧数据兜底
- mergeStateJsonComment 写后读回校验,并发覆盖时在最新状态上重放一次
- webhook 支持 Gitea secret,校验 X-Gitea-Signature(HMAC-SHA256),
  不匹配 401;设置面板新增 Webhook Secret 字段
- 看板新增 我的/全部 范围切换(团队视图),按工作区持久化

vscode/src/issues/stateRouter.ts

@@ -21,6 +21,7 @@ import { getSettings } from '../settings/store'
 import { applyCommand, resolvedStateCommand } from '../youtrack/api'
 import { youtrackHost } from '../youtrack/issueLoader'
 import { mergeStateComment, readStateComment } from '../youtrack/stateComment'
+import { getLocalIssueState, mergeLocalIssueState, splitLocalStateFields } from './localState'
 
 export interface IssueRef {
   /** Absent = gitea (back-compat). */
@@ -58,25 +59,43 @@ async function youtrackAuth(ctx: ExtensionContext): Promise<{ baseUrl: string, t
   return { baseUrl, token }
 }
 
-/** Read the workflow-state blob for an issue from its tracker. */
+/**
+ * Read the workflow-state blob for an issue from its tracker, with this
+ * machine's local record overlaid on top(本地有键即覆盖,'' 墓碑与
+ * "空串=unset" 的既有约定一致)。
+ */
 export async function readIssueState(ctx: ExtensionContext, ref: IssueRef): Promise<Record<string, unknown>> {
+  let base: Record<string, unknown>
   if (isYouTrack(ref)) {
     const auth = await youtrackAuth(ctx)
-    return readStateComment(auth, ref.externalId)
+    base = await readStateComment(auth, ref.externalId)
   }
-  const d = await giteaDeps(ctx)
-  return readStateJsonComment({ ...d, issueNumber: ref.number })
+  else {
+    const d = await giteaDeps(ctx)
+    base = await readStateJsonComment({ ...d, issueNumber: ref.number })
+  }
+  return { ...base, ...getLocalIssueState(ctx, ref.source, ref.number) }
 }
 
-/** Merge `extra` into the issue's workflow-state blob in its tracker. */
+/**
+ * Merge `extra` into the issue's workflow state。机器本地字段
+ * (会话 id / worktree / profile 路径)落 workspaceState,只有共享字段
+ * (column / pr / branch / spec 等)才写进 tracker 评论——跨机没有语义的
+ * 值从此不进共享存储,也不参与多机写竞争。
+ */
 export async function mergeIssueState(ctx: ExtensionContext, ref: IssueRef, extra: Record<string, unknown>): Promise<void> {
+  const { local, shared } = splitLocalStateFields(extra)
+  if (Object.keys(local).length > 0)
+    await mergeLocalIssueState(ctx, ref.source, ref.number, local)
+  if (Object.keys(shared).length === 0)
+    return
   if (isYouTrack(ref)) {
     const auth = await youtrackAuth(ctx)
-    await mergeStateComment(auth, ref.externalId, extra)
+    await mergeStateComment(auth, ref.externalId, shared)
     return
   }
   const d = await giteaDeps(ctx)
-  await mergeStateJsonComment({ ...d, issueNumber: ref.number, extra })
+  await mergeStateJsonComment({ ...d, issueNumber: ref.number, extra: shared })
 }
 
 /**