fix: resolve 12 critical runtime failures, security issue, and dead code

CRITICAL fixes:
- GitStatusPanel: use ipc.file.gitStage/gitCommit instead of non-existent top-level methods
- HeaderFooterDialog: use send/on channels instead of non-existent headerFooter namespace
- CodeMirrorEditor: use invoke('save-pasted-image') instead of non-existent savePastedImage
- ipc.ts: map to correct preload namespaces (git.status, git.stage, git.commit)
- Add pick-folder/pick-file to ALLOWED_SEND_CHANNELS whitelist
- Add git convenience namespace to preload (git.status/stage/commit/log/diff)

HIGH fixes:
- FindReplaceBar: replace broken match count stub with regex-based counter
- PDF export window: disable nodeIntegration, enable contextIsolation + sandbox
- Git handler: accept rootPath argument from renderer
- Add git-diff IPC handler + GitOperations.diff()

MEDIUM fixes:
- Remove 4 dead functions: checkPandocAvailable, safeExecFile, runPandoc, openPDFFile, exportWithPandocPDF
- Remove stale ODT header/footer console.log stub
- Rewrite electron.d.ts to match actual preload API shape

tests/component/modals/ExportPdfDialog.test.tsx

@@ -100,7 +100,10 @@ describe('ExportPdfDialog', () => {
 
   it('renders an error banner when IPC fails', async () => {
     (window as any).electronAPI = undefined;
-    (ipc.print.show as any).mockReturnValueOnce({ ok: false, error: { message: 'Pandoc not found' } });
+    (ipc.print.show as any).mockReturnValueOnce({
+      ok: false,
+      error: { message: 'Pandoc not found' },
+    });
     render(<ExportPdfDialog sourcePath="/test.md" />);
     await userEvent.click(screen.getByRole('button', { name: /^export$/i }));
     await waitFor(() => {