security: minimize desktop webview capability

[kev1n77]

Summary

• replace core:default with the three system APIs actually used by the main WebView: event listen, event unlisten, and save dialog
• keep the capability local-only, bound to the main window, with no remote origins
• extend the deterministic repository policy verifier so missing, broad, remote, non-local, or extra desktop capabilities fail CI
• clarify that the MVP exposes no executable third-party plugin surface; WASI isolation is an enablement gate for a future plugin feature, not an idle runtime dependency

Verification

• python scripts/verify_supply_chain.py
• python -m unittest discover -s scripts/tests -v (26 tests passed)
• npm run desktop:tauri -- info
• git diff --check