feat(desktop): complete Tauri migration through phase 6

[Koh0920]

What changed

• add the Tauri 2 Desktop shell and secure local command adapter
• restore the host-agnostic runner boundary and typed desktop protocol DTOs
• expose Installed Apps and session lifecycle contracts from the CLI
• supervise runner, install, and launch processes as owned process groups
• implement Store, GitHub, local folder, and .capsule imports
• preserve GPUI-compatible install profile, revision, and session identities
• add Launch, Focus, Close, Stop, update, rollback, repair, and remove behavior
• restrict commands to the bundled main window and pin home/app origins
• document the completed phase 1–6 migration contract

Paired frontend and native bundle CI PR: https://github.com/ato-run/ato-pwa/pull/246

Why

The previous desktop path was coupled to the GPUI shell and could not provide the requested Tauri launcher without duplicating runtime policy. This change keeps execution, installation, identity, and process ownership in shared Rust boundaries while making Tauri a narrow native adapter.

Impact

Users receive an offline launcher with persistent Installed Apps, explicit lifecycle controls, PWA handoff, and fail-closed command isolation. Cancelled installs, readiness failures, duplicate launches, and application shutdown now reap owned child processes.

Validation

• clean detached-checkout Tauri build with Desktop frontend materialized automatically
• cargo test -p runner — 29 passed
• cargo test --all-features in crates/desktop-tauri — 11 passed
• cargo clippy --all-targets --all-features -- -D warnings
• macOS offline launch and lifecycle E2E
• Store resolver test plus real GitHub, local folder, and capsule-file imports
• restart persistence and GPUI-compatible identity verification
• Linux arm64 .deb native build
• Windows x86_64 GNU executable cross-link
• native macOS/Windows/Linux bundle matrix runs in the paired private frontend PR

The production Store currently contains no installable capsule revisions, so the live Store path was validated against the resolver fixture rather than a production package.