Add explicit directory navigation with native frecency and zoxide

[raiseCatError]

/dirs and its palette entry now rank recorded directories and restore a literal cd -- 'path' command into the composer. Selecting never executes; a separate Enter uses the normal real-zsh submit path, producing truthful shell state and transcript. Ordinary cd is untouched.

Native frecency aggregates approved history metadata with seven-day recency decay and yields every 2,048 records. Fuzzy queries are cached and stale requests cancelled. Config explicitly offers optional zoxide ranking and the shared Native/fzf/Television picker boundary.

Upstream zoxide query sorts/saves its database, including with --all. The adapter reads db.zo and queries a private temporary copy with bounded argv/output/time; the source database and hooks remain unchanged. Missing, unsupported or failing tools fall back to Native. Database locations respect _ZO_DATA_DIR and the existing macOS/Linux defaults.

Dependency: #237; merge after it. Refs #147.

Validation: build, typecheck, benchmark-script types, git diff --check, full suite (704 passed), focused frecency/100k yielding/quoting/normal-submit tests, and installed zoxide against an isolated fixture with source-byte preservation. Native rank 100k p50/p95 6.56/9.26 ms; cached query 0.02/0.03 ms on macOS arm64 Node 26.8.1. Numbers are informational. Node 22/26 cumulative CI dispatched separately. Physical keyboard/layout/provider QA remains pending. Older journals lacking privacy eligibility do not contribute; zsh-only imported records lack cwd metadata. Directory-specific ghost text is deferred; existing native directory completion remains available.

The initial full run had one status test failure: adding provider rows made the 24-row viewport scroll, hiding Version after Down. Updated the test to reset the viewport before asserting the first row; the final full run passed all 704 tests.

[raiseCatError]

Cumulative CI run 36778848897 failed on Node 22 in the existing GNU screen interoperability test teardown: ENOTEMPTY removing nmsh-live-*/c/nmsh/sessions (Node 26 was cancelled by matrix fail-fast). The error stack is rmSync cleanup in LiveSandbox.dispose after the test body; this layer changes no teardown or directory-writer lifecycle. Local canonical suite passed 704 tests. This is consistent with the existing sandbox/service shutdown race, not a navigation assertion failure. #208 remains parked. Rerunning this unchanged head once after recording the failure; physical QA remains pending.