Add isolated app testing workflow - #4121

💭 Looking at the PR changes, the author addressed the prior feedback by splitting the discriminated SqliteStateInputError into separate error classes for different failure modes. Now I'm reviewing the new t3-sqlite-state.ts file to check for any convention violations in the error classes and other code patterns. The error classes follow the proper structure using Schema.TaggedErrorClass with well-defined attributes. SqliteStateSqlFileError includes the file path and a defect cause, while SqliteStateDatabaseError captures the operation, database path, and cause. The imports look correct—namespace imports from effect subpaths and named imports for pure helpers like the JSON schema utility. The operation discriminator is properly defined as a multi-value literal and used in the database error, which matches the allowed pattern for service-level errors. Let me verify the rest of the error handling patterns. I need to adjust the repo parameter. The SqliteStateDatabaseError wraps both query and exec operations under one generic error, but it does capture structured context like operation and databasePath while preserving the underlying cause, which aligns with the conventions since the operation discriminator provides meaningful context. Let me continue checking the other error patterns. The input validation errors with empty fields are actually fine since they're pure domain errors with static messages, which the convention allows. I'm checking whether mapError on line 238-245 causes double-wrapping of domain errors, but resolveSqlSource runs first so those errors bypass the wrapper—no issue there. Now I'm verifying the SqliteStateDatabaseError doesn't violate the convention about encoding distinctions twice. The operation discriminator is multi-valued (query|exec) while the tag is specific, so there's no redundant encoding. The config.ts and DesktopEnvironment.ts changes are straightforward and don't introduce convention violations. For the CLI imports from effect/unstable/cli, I need to determine whether this is a subpath package or module to verify if the named imports follow the convention correctly. Now I'm checking whether the error definitions properly use Schema.Defect() — the convention requires that the tag, fields, or both must structurally identify the failure, not just serve as a generic error container. Looking at SqliteStateSqlFileError and SqliteStateDatabaseError, they both have distinct tags, include relevant fields like filePath and operation, and preserve the cause without stringifying it into the message. That's the correct pattern, so this is solid. Let me do a final sweep of the other touched files like config.ts and DesktopEnvironment.ts to make sure nothing else violates the conventions — though those changes are just small path-derivation logic, not service-level concerns. Since the prior issue is now fixed, I don't need to add another comment. There's a tension between the system requirement to output valid JSON and the customer's instruction to respond with "All clear" when there are no findings, but the JSON schema is authoritative for output format, so I'll set the check state to success with no findings. The config file looks good and follows the right patterns. The earlier error handling issue got resolved by breaking it into separate exception classes, and there are no new problems to flag. I'll format the response as JSON with a success status and an "All clear" message like the customer requested.