feat(ohos): mobile native plugins, bridge facade adaptation, and permission request fallbacks - #25

…ission request fallbacks

- New OHOS ArkTS plugins: geolocation, barcode-scanner, biometric, haptics,
  nfc; notification registerListener/removeListener + action dispatch
- geolocation watchPosition channel emit streaming; requestPermissions
  four-path settle fallback (requestPermissionsFromUser promise can hang
  on map-preview dialog) + polled permission read
  (selfPermissionStateChange fires before ATM commit)
- barcode-scanner: same settle fallback pattern for CAMERA permission
- bridge facade adaptation + OHOS cross-check enablement
- OHOS adaptations for opener/clipboard/window-state/single-instance/
  process/notification; cfg isolation fixes
- gate opener/window-state desktop-only APIs for mobile compile; fix
  window-state update_state freeze (skip sync is_minimized/is_maximized)

Verified on device: geolocation permission dialog grant path settles in
~3s with correct granted status; watchPosition emit streaming works.

Co-Authored-By: Claude <noreply@anthropic.com>

The OHOS save branch previously skipped update_state() and only refreshed
position when StateFlags::POSITION was set, relying on event-driven caches
(stale on save races; Moved never fires on OHOS). Since tao's
inner_size()/outer_position() are non-blocking per-window cache reads
(only is_maximized/is_minimized block via sync NAPI — those stay skipped),
refresh both size and position for every tracked window before serializing.
serde serializes the whole WindowState struct, so SIZE-only saves also
persisted stale x/y — refreshing both fixes restore-to-(0,0).

Part of openspec change p1-window-state-per-window-rect (Phase 1+2, D7).

Co-Authored-By: Claude <noreply@anthropic.com>

… dispatcher round-trips

Two same-pattern AB deadlocks fixed (faultlogs 2026-08-25 x3 captured
both sides: tokio worker holds WindowStateCache lock -> window_getter!
rx.recv() waits on main thread, main thread in Resized/Moved handler
waits on the same lock -> permanent THREAD_BLOCK_6S):

- save_window_state: three phases — short lock snapshots tracked labels,
  fresh geometry (outer_position/inner_size) collected unlocked, short
  lock writes back + serializes, fs::write outside. Err/0x0 keeps the
  cached value (Option, old if-let semantics preserved).
- restore_state (p3): same discipline — unlocked fs::read of the saved
  state, short lock snapshot/default-seed, then all window operations
  (available_monitors/set_position/set_size/show/set_focus setters are
  fire-and-forget dispatches) outside the lock. Triggered by the default
  StateFlags::all() which includes POSITION — production default, while
  the old test only passed SIZE (coverage blind spot, now closed with an
  all-flags auto test in examples/api).

Non-OHOS paths are kept byte-for-byte under cfg(not(target_env="ohos")).
RestoringWindowState guard unchanged (handlers use try_lock).

Verified on device: full suite 282 pass / 1 fail (clipboard platform
limit) / 1 skip (haptics), all-flags restore via worker path 705ms no
appfreeze, zero new faultlogs.

Co-Authored-By: Claude <noreply@anthropic.com>

Remote-only commit is the pre-rebase push of work that was replayed
(and further refined) during the upstream-ohdev rebase; local content
is authoritative (-s ours). See upstream-ohdev-rebase-window-ops.