fix(desktop): harden final Desktop 2.0 delivery

[abraxas914]

Summary

This PR hardens the final Desktop 2.0 fork delivery across rendered content, data import, packaged runtime refresh, Tauri security, and release publication. It preserves the four specialist commits as reviewable units and adds one documentation-only integration commit.

Rendered content and React assets

• Replaces unconditional KaTeX trust with a narrow policy that permits only safe HTTP(S) links for supported link commands and rejects remote resource commands and dangerous schemes.
• Applies one explicit URL policy to Markdown, summaries, KaTeX-generated links, and the Tauri opener path.
• Blocks automatic remote HTTP(S) Markdown images while retaining narrowly scoped local, asset, blob, and safe bitmap data sources.
• Adds regressions for malicious schemes, remote images, normal formulas, safe local images, and normal HTTPS links.
• Removes the unused React v2 Azonix/font tree and dead legacy public CSS/JS assets.
• Keeps the standalone bootstrap fallback and logo, and adds positive/negative source and dist asset contracts.

Memory, sessions, and cost accounting

• Makes memory/session import transactional with validation, staging, target backup, atomic activation, and rollback.
• Preserves source-wins memory semantics, add-only model responses, and desktop-session deduplication without executing source code.
• Prevents concurrent response creation from being overwritten and rejects unsafe backup destinations and linked paths.
• Hardens the append-only cost ledger for concurrency, corrupt tails, atomic compaction, repeated initialization, and legacy snapshot migration.

Packaged runtime and Tauri security

• Refreshes stale same-version packaged runtime code while preserving user data and avoiding writes into the packaged application.
• Uses staged runtime activation with rollback when refresh fails.
• Validates local bridge/conductor endpoints and keeps diagnostics bounded and redacted.
• Adds production CSP directives for local Tauri/IPC, bridge, conductor, asset, image, media, and worker requirements without production unsafe script execution.
• Scopes main/setup capabilities by window and keeps WebDriver permissions isolated to the e2e configuration.
• Keeps dynamic loopback-port CSP allowances isolated to the e2e configuration; production CSP remains fixed-port and wildcard-free.

Release and package hardening

• Limits the release workflow to three read-only platform builders and one write-enabled publisher.
• Pins trusted Actions, Node, Rust, python-build-standalone archives, and their SHA-256 digests.
• Locks direct and transitive runtime requirements and hash-locks DMG layout build inputs.
• Excludes the already embedded React dist from the packaged Python runtime and hard-fails if it re-enters.
• Publishes only after all three builders succeed, verifies the exact six-file staging set and checksums, then exposes one atomically prepared prerelease.
• Keeps optional heavy P2P dependencies out of portable packages and removes build tools/bytecode caches from packaged runtimes.

Validation

• npm ci
• npm run typecheck
• npm run test:e2e-types
• Full Vitest: 53 files, 394 tests passed
• npm run test:ci-contract
• Packaging contract: 43 passed, 0 failed; PowerShell parser unavailable locally and reported as one warning
• Production Vite build: 3,312 modules; 17 JS and 14 CSS bundles; 4,253 KB assets
• Bundle and production e2e-isolation contracts passed
• Browser E2E: 2 specs, 10 journeys passed
• Python Desktop suite: 150 passed, 1 optional import skip
• Rust fmt and strict Clippy passed for default and e2e feature sets
• Rust tests passed for default and e2e feature sets (15 tests each)
• Tauri production and e2e-feature release builds passed with --no-bundle
• Actionlint 1.7.12 passed for every workflow
• Production dependency audit: 0 vulnerabilities

Boundaries and known risks

• frontends/desktop/static/** (Desktop v1) is byte-for-byte unchanged.
• agentmain.py, llmcore/**, memory/**, and local-only agent/spec directories are unchanged.
• React dist/** was rebuilt and inspected locally but remains ignored and is not committed in this fork PR.
• The inherited P0 loopback trust/authentication risk is intentionally not addressed in this PR.
• macOS output is ad-hoc signed only. No official Developer ID signing or notarization was performed, and release notes disclose this limitation.
• This PR does not publish a release and does not modify or replace upstream PR feat(desktop): integrate compiled React Desktop 2.0 lsdefine/GenericAgent#776.