Conversation picker shows a degraded source's partial list as complete #1433

Residual from #1411 (review c, rounds 1 and 2).

The conversation picker has no "partial result" signal for any source. When a source degrades, the picker shows the rows it got as if they were the whole list:

• Codex without its SQLite index (an existing downgrade);
• Codex skipping an unreadable rollout or a malformed index row (fix: one bad record no longer fails the whole set (C5 rows 8–12, #1251) #1411 row 8).

A user can read a missing session as "no such session".

Today:

• CodexConversationSource.lastDowngradeReason() records the reason, and fix: one bad record no longer fails the whole set (C5 rows 8–12, #1251) #1411 adds skip counts, a discovery-span field and one console warning. No production caller reads it.
• ConversationService flattens source rows into Discovery and list() without any per-source status (src/main/conversations/service.ts).

Shape of a fix (not designed): carry a per-source degraded?: { reason } through Discovery and ConversationListResponse, and render one bounded, curated line in the picker (q39). Never pass the raw reason or paths to the UI.

Found by: #1411 review (c). Recorded evidence: the recorded corpus with three unreadable unindexed rollouts. The indexed rows return and the scanned rows are silently absent.

🤖 Generated with Claude Code