fix(word-addin): open reference downloads in the system browser

WHY THIS MATTERS
The new Assets download button called window.open() directly. In Office
task-pane webviews - notably desktop Word - window.open is blocked, so the
click did nothing, with no error shown. This add-in already documents the
problem: ApiKeyBanner.tsx says "window.open is blocked in some hosts" and
uses the sanctioned escape hatch. New code has to follow the same rule or
the feature silently works only in a browser tab.

WHAT IS Office.context.ui.openBrowserWindow?
Office.js's supported way to open a URL from inside the task-pane sandbox:
it asks the host application (Word) to launch the user's default browser.
window.open stays as the fallback for environments without Office.js (the
hermetic e2e bundle, plain-browser development).

HOW THE FIX WORKS
- Download now resolves the signed URL and hands it to a small
  openExternalUrl() helper mirroring the ApiKeyBanner pattern.
- Bonus hardening in the same component: the reference-file list effect now
  carries a cancelled flag (fast workflow switching can no longer render a
  previous workflow's files, matching every other fetch effect in this PR)
  and a failed list fetch surfaces its error instead of quietly rendering
  "No reference files."

Found by review of PR #309.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4PXCdenNH5Mqhm5Sre9Zs