Add stale-pending-task detection

[VeryComplexAndLongName]

Summary

• A pending task untouched (per git blame) longer than a configurable threshold (default 14 days) is now flagged in the Change Timeline view — a distinct warning marker, not a notification.
• Reuses the existing blame computation entirely, no new git calls: ChangeTimelineTask.lastTouchedDate is always populated (done or not), distinct from the completion-only date field (kept deliberately restricted to checked tasks in the prior change, to avoid misreading as a completion date).
• isTaskStale/findStaleTasks (packages/core/src/stale-tasks.ts) are pure date-math, shared by both hosts: a "Stale after (days)" input in the standalone Timeline tab, and a new openspec-ui.staleTaskThresholdDays VS Code setting.
• Also re-points change-timeline-client.ts at core's real @openspec-ui/core/browser types instead of a hand-duplicated copy — the duplicate had already drifted out of sync once (missed this exact new field) before this change stopped it for good.
• Deliberately out of scope: the multi-change comparison view (doesn't plot pending tasks at all today), a tree-view badge (would need an independent background blame scan), and any proactive notification (consistent with this project's local-first, no-noise stance).
• Versioned via a changeset: @openspec-ui/core 0.27.0 -> 0.28.0, @openspec-ui/webui 1.13.0 -> 1.14.0, openspec-ui-vscode 0.24.1 -> 0.25.0 (all minor).

Verification note

Learned from the prior CSP bug (#94): manually verified against the real CSP shape TimelineWebviewPanel.getHtml() actually produces (same nonce, same dual-global embedding), not a bare unrestricted page — a synthetic genuinely-stale task and a fresh pending task both rendered correctly with zero console errors.

Test plan

• stale-tasks.test.ts (new), change-timeline.test.ts updated for lastTouchedDate
• ChangeTimelineView.test.tsx: stale/fresh rendering with a deterministic now
• timeline-panel.test.ts and commands.test.ts updated for the new parameter/setting, including a dedicated test asserting the VS Code setting is actually read
• npm run typecheck, npm run lint (including lint:english), npm run test workspace-wide
• npm run package --workspace openspec-ui-vscode — VSIX packages without error
• Real-CSP Playwright verification (see above)
• openspec change validate --strict add-stale-task-detection

🤖 Generated with Claude Code