Implements Task 3 of v0.9.0 Plan C: three org-write SW handlers in org-handlers.ts.
Each handler decrypts the FULL manifest via org_manifest_decrypt (unfiltered) before
mutating it — never state.manifest (filtered) — preventing silent wipe of ungranted
collection entries on re-encrypt. Grant checked before any network call for add;
checked post-lookup for update/delete. Delete is manifest-only (soft-delete via
trashed_at); item blob stays on disk. All three return org_offline when offline.
Commit signer built from get_device_info + rawSign wrapping sign_for_git output.
Wired: PopupMessage union + POPUP_ONLY_TYPES (messages.ts) + dispatch (popup-only.ts).
Tests: 7/7 org-write.test.ts (RED→GREEN); full SW suite 210/210; tsc clean.
50a05affcb