v0.51.15 — 4-PR contributor batch + 1 self-built

✨ Added

#1769 by @nesquena-hermes — Three high-leverage context-menu essentials (Reveal-in-finder, Copy-path, Open-with-system) on attachment chips. Self-built, independently APPROVED by @nesquena. Path validation via safe_resolve(), all shell-outs use list-form subprocess.Popen (no shell=true). Closes #1764.

#1767 by @Michaelyklam — Use spawn for manual cron subprocesses. Closes #1754 (architectural follow-up from v0.51.12). Eliminates the fork-from-multi-threaded-WebUI hazard class (import-lock and logging-lock inheritance no longer apply, since spawn starts a fresh interpreter). +207 LOC of regression coverage including end-to-end harness showing fork deadlocks vs spawn succeeds.
#1770 by @Michaelyklam — Surface Codex usage exhaustion errors. Closes #1765. New quota_exhausted SSE event distinguishes quota (requires re-auth) from rate-limit (just wait). Replaces previous empty-turn behavior with clear inline error card. Preserves PR #1760's user-turn data-loss fix.
#1762 by @bergeouss — Add missing openrouter/ prefix for tencent/hy3-preview:free in _FALLBACK_MODELS. Closes #1744. One edge case filed as #1776 follow-up (custom provider + :free suffix combination).

4662 → 4694 collected (+32 across 4 new test files). 4687 passed, 0 failed.

All 4 PRs CI-green individually + auto-merged cleanly (different functions in overlapping files).
node -c clean on all 4 changed JS files.
Browser API sanity (11/11 endpoints) — all pass.
Opus advisor: SHIP all 4, 0 MUST-FIX. 2 SHOULD-FIX (one absorbed in-release: editable-install detector tightened; one filed as #1776).

Full Changelog: v0.51.14...v0.51.15