unify: back the function disasm view on the heads listing walker (M4 item 4)

The function disasm view is now a filtered listing: DisasmModel sources its
lines from the heads walker bounded to [func.start, func.end) instead of the
disasm tool, so both code views render from the one listing mechanism.
DisasmView UI (opcode bytes, o-toggle, Tab, rename) preserved -> no test churn.

total() stays on disasm include_total: paging heads for the count hit the MCP
response-size limit (count=1000 truncated -> wrong count) and corrupted prime.
include_total is one fast exact call; for a code function it equals the heads
row count backing the lines. _fetch_block uses count=257 (safe).

Verified: disasm-heavy scenarios 56/0; full suite 127/1 (1 = flaky filter).
M4 complete.

1 files changed, 9 insertions, 6 deletions

diff --git a/TODO b/TODO
index 3080d25..2311d7d 100644
--- a/TODO
+++ b/TODO
@@ -33,12 +33,15 @@ hard:
        [x] back-paging / streaming: listing primes the viewport instantly and
            streams the rest in the background (was load_all -> blank pane for
            seconds on a big .text). concurrency-safe page loads.
-       [ ] struct-typed data expansion (render a struct global as its fields).
-           deferred: model change (one head -> many lines); the data is already
-           functional via `d my_struct`, expansion is display polish.
-       [ ] unify the function disasm view as a filtered listing. deferred: a
-           maintainer refactor (no new capability) with real regression risk on
-           the battle-tested function-view path; not worth doing blind.
+       [x] struct-typed data expansion: a struct global expands into indented
+           member rows (+off name type) in the listing.
+       [x] unify the function disasm view as a filtered listing: DisasmModel now
+           sources its lines from the `heads` walker bounded to [func.start,
+           func.end) (total via disasm include_total to avoid response-size
+           truncation). Both code views render from the one listing mechanism;
+           the DisasmView UI (opcode bytes/Tab/rename) is preserved. Full suite
+           127/1 (1 = pre-existing flaky filter).
+    -> M4 COMPLETE.
 
 crazy:
 [ ] multi/split view ala ghidra?