feat: move desktop runtime behind app server

[oratis]

Summary

• make the supervised app-server protocol the desktop chat runtime and remove the renderer-side provider/tool loop
• expose status-only credentials, remove native mutation commands, and keep plaintext provider credentials inside the sidecar
• load only trusted user settings in the desktop runtime while retaining session-backed file snapshots without a second message writer
• project structured turns, tools, usage, approvals, and user input into the existing UI, including fast-terminal buffering and stale-turn isolation
• split dependency-free model metadata from the provider implementation so provider/OpenAI SDK code is absent from renderer bundles

Validation

• pre-commit: format, lint, typecheck, 952 tests passed; 12 environment-dependent tests skipped
• Rust: 35 tests passed
• pnpm build
• frozen lockfile check and docs consistency check
• production renderer and source maps: zero matches for provider implementation, browser credential flag, legacy runtime names, or credential env names
• real arm64 DeepCode.app build with bundled Node 22 runtime and 229,175-byte app-server
• nested runtime plus outer app ad-hoc signing; codesign --verify --deep --strict passed
• bundled sidecar no-credential lifecycle E2E produced ordered turn failure events

Follow-up

Developer ID signing/notarization remains a release gate. Browser fixture and visual desktop journeys remain in the next stacked PR.

[oratis]

Review: approved ✅ — closes threat #1 for the desktop app

This is where the renderer stops being a trusted runtime. Per docs/security-model.md, threat #1 is "model exfiltrates the DeepSeek API key", and until now the desktop renderer held provider credentials and ran the agent loop inside a WebView. That's fixed here.

Verified in the Rust diff

• read_credentials → credential_status, returning presence/base_url only. There is a test asserting the serialized status never contains api_key or auth_token — that's the assertion that keeps this from regressing.
• reject_credentials_path() blocks the renderer's read-only file preview from resolving to the backend credentials file, with tests for both the credential path and an ordinary workspace path. Without this, "read-only file preview" would have been a complete bypass of everything else in this PR.
• Native mutation commands removed; the renderer's only mutation route is the versioned protocol.

Also good

• Only trusted user settings load in the desktop runtime — an untrusted project can no longer influence desktop runtime config, consistent with the trust work landing in feat: add trust-aware config diagnostics #197.
• Model metadata split from the provider implementation so the OpenAI SDK and provider code are absent from renderer bundles. This is the part that makes "no credentials in the renderer" structurally true rather than merely currently true — you can't exfiltrate through a client that doesn't contain the code.
• Fast-terminal buffering and stale-turn isolation preserve the UI behaviour the previous in-renderer loop provided, so this isn't a functionality regression dressed as a security fix.

Note: −1036 lines. Deleting the second agent loop is the real win — two implementations of the same policy is how the VS Code/LSP gate bypass in #181 happened in the first place.

Validation: CI green; desktop 62 tests pass locally at the stack tip.