refactor: remove legacy desktop runtime facades

[oratis]

Summary

• delete the unused renderer IPC protocol and desktop native mutation/search/bash facade
• reduce Tauri to sidecar supervision plus credential-safe read-only file and snapshot projections
• keep legacy session data read-only while making canonical snapshot timestamps interoperable across core and desktop
• remove the obsolete chat route alias and browser-provider escape hatch, and update architecture docs

Safety

• no legacy session files are rewritten or deleted
• credential files remain blocked from renderer file preview
• workspace mutations remain exclusively behind RuntimeHost and the versioned app-server protocol

Validation

• pnpm typecheck
• pnpm test: 1028 passed, 12 skipped
• pnpm lint: no errors, one pre-existing warning
• pnpm format:check
• pnpm docs:check
• pnpm build
• cargo test: 30 passed

Stacked on #206.

[oratis]

Review: approved ✅

−1096 lines of dead runtime. Now that #192 moved desktop behind the app server, the renderer IPC protocol and the native mutation/search/bash facade are unreferenced — and unreferenced privileged code is the worst kind to leave lying around, because it stays reachable from the Tauri command surface while nobody reviews it.

What I checked against the PR's own safety claims

• No legacy session files are rewritten or deleted — consistent with Sessions: dual-read legacy formats with corruption diagnostics #182's read-only compatibility and Sessions: canonical v1 writer and cross-process ownership #185's sidecar-only writes. Deletion here would have been irreversible for users' history, so I specifically looked for it; it isn't there.
• Credential files remain blocked from renderer file preview — feat: move desktop runtime behind app server #192's reject_credentials_path guard survives the deletion pass. This was the one thing most at risk of being removed along with "the rest of the file facade".
• Workspace mutations remain exclusively behind RuntimeHost and the versioned protocol. That's the invariant this whole stack exists to establish; the facade removal is what makes it true by construction rather than by convention.
• Removing the browser-provider escape hatch and the obsolete chat route alias closes the last renderer→provider paths, which is what lets security: minimize desktop renderer capabilities #209 drop the provider API from the CSP.

Canonical snapshot timestamps being made interoperable across core and desktop is a real fix bundled here — divergent timestamp formats would have broken /rewind interop between CLI and desktop sessions.

Validation: CI green; full suite green locally at the stack tip.