Review fixes for waves 9-10; preload covers so Save stops waiting on them

Orchestrator review of b600df6 and cf82cbc (the chain's gate only proved they built).

Fixed:
- Search: "In your library" now shows the merged set (owned editions reached only via
  an online ISBN were removed from "Online" and shown nowhere); the shelf filter applies
  to it and hidden owned matches are counted.
- "Edit details" closes the online save sheet (left open, it invited a duplicate save).
- A failed remembered-shelf write after a successful insert no longer reports
  "Couldn't save" (a retry would duplicate the book).
- Library search no longer normalizes every book on every keystroke on the main thread.
- Add-by-hand duplicate check and the scan sheet's save are guarded (no crash, no
  double-tap duplicate, CancellationException rethrown).

Covers (design decided with the user): createBook used to download the cover before
writing the row, so every save waited on the image host, and a failed download silently
saved no cover file. The cover now downloads as soon as a sheet has its URL; Save waits
for it if needed and copies the file into place. A failed download shows on the sheet
with Retry, and Save becomes "Save without cover". Unsaved preloads are discarded, and
leftovers from a killed process are swept at startup.

337 tests (was 308), 2 skipped, 0 failures; assembleDebug and verifyPaparazziDebug green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

logs/CHAIN-DONE

@@ -0,0 +1 @@
+chain complete 2026-09-15T18:28:39+00:00

logs/WAVE10-DONE

@@ -0,0 +1,4 @@
+=== WAVE 10 (L-search) passed the chain gate 2026-09-15T18:28:39+00:00 ===
+commit cf82cbc (pushed); tests 308; worker $10.452535, 157 turns
+Mechanical gate only. Orchestrator must still review: read logs/L-search.summary,
+eyeball new Paparazzi PNGs, and read the diff (git show --stat cf82cbc).