Bundle 48: desktop contract and Python sidecar supervisor prototype

[nulleimy]

Goal

Prove the risky desktop foundation before visual UI work:

trusted desktop core
  -> packaged/controlled Python sidecar
  -> loopback-only authenticated transport
  -> health/readiness nonce validation
  -> native-selected library capability
  -> bounded scan
  -> normalized redacted response
  -> bounded shutdown without orphan process

Required scope

• versioned desktop/sidecar protocol contracts
• per-launch credential and process nonce
• loopback-only binding validation
• authenticated product endpoints
• health and readiness envelope
• bounded startup timeout
• bounded restart/crash-loop policy
• graceful then forced shutdown model
• opaque library-root capability contract
• rejection of arbitrary renderer path
• tests for wrong nonce, missing credential, expired capability, non-loopback binding and hanging shutdown
• schema tree and operator/developer documentation

Isolation

• no full React UI
• no production updater
• no signing/notarization workflow yet
• no arbitrary shell or filesystem bridge
• no production provider default change
• no network exposure beyond loopback

Base

e498e93db2873723ad26dba3ea686db5f3a4a930

Acceptance

• Python 3.11 and 3.12 CI
• PR Guard
• deterministic unit/integration tests
• no orphan process in supervisor tests
• no secret or absolute path leakage in renderer-safe responses
• rollback by reverting one isolated squash commit