B3c — per-file and per-step rollback service (file-write-safety series #1375)

[easonLiangWorldedtech]

Part of the file-write-safety series (#1375).

B3c — per-file and per-step rollback service (extension host).

Planned scope:

• rollbackFile(checkpointId, filePath) — restore a single file from a checkpoint via the shadow-git restore path (ShadowCheckpointService.restoreFile: single-file git checkout -- ; delete the file when it did not exist at the checkpoint).
• rollbackStep(stepCheckpointIds, files?) — restore every file a step touched, resolving the step's files from the B2 change journal (changes.jsonl); with a step checkpoint id, files absent from that checkpoint's journal entries fail explicitly.
• Webview UI (the rollback buttons) ships separately in B3b (tracking Tracking B3b: change cards webview UI and rollback buttons #1402).

This PR exists because the combined B3a scope (cards + setting + rollback) exceeded the series' 1000-line diff cap, so the rollback service split out as a stacked sub-PR (cards + setting ship first as B3a, tracking #1401).

PR: #1410