fix: resolve 12 critical runtime failures, security issue, and dead code

CRITICAL fixes:
- GitStatusPanel: use ipc.file.gitStage/gitCommit instead of non-existent top-level methods
- HeaderFooterDialog: use send/on channels instead of non-existent headerFooter namespace
- CodeMirrorEditor: use invoke('save-pasted-image') instead of non-existent savePastedImage
- ipc.ts: map to correct preload namespaces (git.status, git.stage, git.commit)
- Add pick-folder/pick-file to ALLOWED_SEND_CHANNELS whitelist
- Add git convenience namespace to preload (git.status/stage/commit/log/diff)

HIGH fixes:
- FindReplaceBar: replace broken match count stub with regex-based counter
- PDF export window: disable nodeIntegration, enable contextIsolation + sandbox
- Git handler: accept rootPath argument from renderer
- Add git-diff IPC handler + GitOperations.diff()

MEDIUM fixes:
- Remove 4 dead functions: checkPandocAvailable, safeExecFile, runPandoc, openPDFFile, exportWithPandocPDF
- Remove stale ODT header/footer console.log stub
- Rewrite electron.d.ts to match actual preload API shape

src/main/files/git.js

@@ -4,33 +4,42 @@ const { ipcMain } = require('electron');
 const GitOperations = require('../GitOperations');
 
 function register(currentFileRef) {
-  ipcMain.handle('git-status', async () => {
-    const dir = currentFileRef.current
-      ? require('path').dirname(currentFileRef.current)
-      : process.cwd();
+  ipcMain.handle('git-status', async (_event, rootPath) => {
+    const dir =
+      rootPath ||
+      (currentFileRef.current ? require('path').dirname(currentFileRef.current) : process.cwd());
     return GitOperations.getStatus(dir);
   });
 
-  ipcMain.handle('git-stage', async (_event, { files }) => {
-    const dir = currentFileRef.current
-      ? require('path').dirname(currentFileRef.current)
-      : process.cwd();
+  ipcMain.handle('git-stage', async (_event, { rootPath, files }) => {
+    const dir =
+      rootPath ||
+      (currentFileRef.current ? require('path').dirname(currentFileRef.current) : process.cwd());
     return GitOperations.stage(dir, files);
   });
 
-  ipcMain.handle('git-commit', async (_event, { message }) => {
-    const dir = currentFileRef.current
-      ? require('path').dirname(currentFileRef.current)
-      : process.cwd();
+  ipcMain.handle('git-commit', async (_event, { rootPath, message }) => {
+    const dir =
+      rootPath ||
+      (currentFileRef.current ? require('path').dirname(currentFileRef.current) : process.cwd());
     return GitOperations.commit(dir, message);
   });
 
-  ipcMain.handle('git-log', async () => {
-    const dir = currentFileRef.current
-      ? require('path').dirname(currentFileRef.current)
-      : process.cwd();
+  ipcMain.handle('git-log', async (_event, rootPath) => {
+    const dir =
+      rootPath ||
+      (currentFileRef.current ? require('path').dirname(currentFileRef.current) : process.cwd());
     return GitOperations.log(dir);
   });
+
+  ipcMain.handle('git-diff', async (_event, filePath) => {
+    const dir = filePath
+      ? require('path').dirname(filePath)
+      : currentFileRef.current
+        ? require('path').dirname(currentFileRef.current)
+        : process.cwd();
+    return GitOperations.diff(dir, filePath);
+  });
 }
 
 module.exports = { register };