Open the macOS app's dashboard in its own window

[myles332]

First phase of the desktop app. The macOS OpenResearch.app now shows the dashboard in its own window instead of opening the user's browser. Windows and the Linux AppImage follow in separate PRs.

What changes

• Window: tao owns the AppKit run loop and wry hosts the dashboard in a WKWebView at http://127.0.0.1:<port>. The existing loopback and same-origin guards, SSE and WebSockets work unchanged.
• Menu bar (muda):
  • The standard App, Edit, View and Window menus, plus Reload (Cmd+R).
  • Closing the window hides it; clicking the Dock icon brings it back.
  • Cmd+Q loads about:blank so the page's pagehide flush saves workspace state, then sends SIGTERM to its own process so orx up stops agents and exits through its normal shutdown. A 5s fallback forces the exit.
• Pop-ups: every window.open and target=_blank link opens in the system browser. Only http, https and mailto links are passed on, so agent-written HTML can't launch other URL-scheme apps without a prompt. An injected window.__ORX_DESKTOP__ flag lets RemoteHostDialog open the remote gateway in the browser once the session exists.
• Downloads: a native Save panel. If the target already exists, it is removed first, because WebKit refuses to download over an existing file.
• window.confirm: wry's WKUIDelegate has no confirm panel, and without one WebKit answers every confirm with false. The app adds the method at runtime and shows an NSAlert.
• Port: the app prefers 4792 and falls back to an ephemeral port if it's taken. localStorage is keyed by origin, so a fixed port keeps it across launches.
• Removed: the Dock-click tab-focus JXA, the Apple-events entitlement and NSAppleEventsUsageDescription, and has_live_dashboard_clients.

Known gaps

• Dock-menu Quit and logout still use AppKit's terminate:, which skips the pagehide flush and the agent shutdown. That matches today's behaviour.
• CI has no macOS job, so the new macOS-only code is compiled only locally and by the release build.

Test plan

• cargo fmt --check, cargo clippy --all-targets -D warnings, cargo build --locked, cargo test --locked (923 passed)
• UI i18n and style checks, typecheck, 198 UI unit tests, dev-slot tests; ui/dist rebuilt from source
• Local unsigned .app against an isolated data dir: the window opens after the dashboard loads, and WebKit connects to the server
• Links, downloads, confirm prompts, copy/paste, reload, and close/Dock-reopen checked by hand on the first build
• Cmd+Q stops the Claude workers and exits cleanly
• Downloading over an existing file with Replace saves the file
• "Open raw" and chat attachments open in the system browser
• Remote host opens its gateway in the system browser
• The window keeps drawing while a confirm alert is up
• Signed and notarized universal DMG (ORX_APP_UNIVERSAL=1) launches and loads the dashboard
• An update restart relaunches into a new window on the same port

🤖 Generated with Claude Code