fix(security): higiene Tauri SRC-004 (capabilities y runtime)

[Alexendros]

Summary

• Fija tauri =2.12.1 y tauri-build =2.7.1, y @tauri-apps/api de apps/web a 2.12.1 ([Task] SRC-004 — Fijar versiones exactas de Tauri (crates + JS) #31).
• Elimina capabilities dialog/picker del MVP; documenta reserva v1 y denegación por ausencia de permiso ([Task] SRC-004 — Denegación por ausencia de permiso (sin campo denied) #33, [Task] SRC-004 — Retirar dialog.json y picker.json del MVP #34).
• Añade tools/validate_tauri_schemas.py en CI y job security-runtime con prueba negativa IPC ([Task] SRC-004 — Verificar tauri.conf.json sin propiedades fuera de schema #30, [Task] SRC-004 — Validar capabilities contra desktop-schema reproducible #32, [Task] SRC-004 — Job CI security-runtime y pruebas negativas #35).
• Completa captura SRC-004 (URL, versiones, claimId, SHA-256 de desktop-schema.json) ([Task] SRC-004 — Completar captura en source-register.md #36).

Cierra #30 #31 #32 #33 #34 #35 #36.

Test plan

• python3 tools/validate_tauri_schemas.py
• python3 tools/check_negative_capabilities.py
• cargo test -p archmaker --locked security_runtime_deny_ungranted_command
• cargo test --workspace --locked
• CI verde en PR (incl. job security-runtime)

---

Note

Medium Risk
Touches Tauri ACL, IPC gating, and pinned desktop dependencies; changes are deny-by-default with new CI enforcement rather than broadening permissions.

Overview
Hardens Tauri security for MVP (SRC-004) by pinning the stack to 2.12.1 (tauri / tauri-build / @tauri-apps/api) and recording the capture (claim, desktop-schema.json SHA) in governance docs.

MVP capability model: removes dialog/picker capability JSON from the tree; only main.json with empty permissions remains. Static checks (Rust, Python) and policy docs now assert absent v1-reserved files instead of empty allow-lists.

CI and runtime proof: adds tools/validate_tauri_schemas.py on the Rust job and a dedicated security-runtime job that runs security_runtime_deny_ungranted_command—mock IPC must reject ungranted commands (e.g. create_draft) when capabilities grant nothing.

Code layout: desktop Tauri commands and startup move from main.rs into lib.rs (archmaker::run()), with the negative IPC test colocated and tauri’s test feature enabled for mock runtime.

^{Reviewed by Cursor Bugbot for commit e8c087a. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: e7ab75af-44ac-415f-b9c4-b7570cb26f76)