feat(platform): enforce Tauri command authority

[decode2]

Linked issue

Closes #41

• The linked issue has the status:approved label.

Pull request type

Select exactly one option and apply the matching type:* label.

• Bug fix (type:bug)
• New feature (type:feature)
• Documentation (type:docs)
• Refactor (type:refactor)
• Maintenance or tooling (type:chore)
• Breaking change (type:breaking-change)

Summary

• Enforce a finite 14-command Tauri authority manifest with paired generated allow/deny contracts.
• Grant target-specific authority through separate Linux and Windows capabilities and verify handler/build/manifest parity.
• Replace feat(platform): enforce Tauri command authority #42 with the same approved final tree as one clean commit; Linux pty_spawn authority remains deferred to task 3.2.

Supersedes #42.

Changes

Area or file	Change
apps/desktop/src-tauri/build.rs	Declare the finite command manifest for Tauri authority generation.
apps/desktop/src-tauri/capabilities/{linux,windows}.json	Grant target-specific authority to the main window; Linux excludes pty_spawn.
apps/desktop/src-tauri/permissions/terminal.toml	Define the finite terminal permission set.
apps/desktop/src-tauri/permissions/autogenerated/*.toml	Check in all 14 generated allow/deny command contracts.
apps/desktop/src-tauri/tests/authority_manifest.rs	Enforce exact handler, manifest, target capability, and generated-contract parity.

Review budget: 288 authored changed lines plus 154 generated changed lines across 19 paths. Generated contracts are complete and excluded from the authored 400-line budget.

Test plan

• Ran the focused automated checks: cargo test -p splice-shell-desktop --test authority_manifest && cargo test -p splice-shell-desktop --test platform_authority && cargo test -p splice-shell-desktop --lib open_path_rejects_missing_paths (5/5 passed).
• Exercised the affected terminal, AI CLI, or desktop workflow: static/build authority generation and parity were exercised by the focused tests; packaged-runtime unauthorized invocation is intentionally N/A for task 3.1b.
• Verified relevant Windows, Linux, or WSL behavior, or documented why it is not applicable: native check/scoped Clippy and Windows GNU check/Clippy passed; Linux-native WSL uses the Linux capability model.
• cargo fmt --all --check and git diff --check passed.

Warnings: strict native Linux Clippy remains baseline-blocked by two unchanged splice-clipboard dead-code diagnostics. Scoped native Clippy and Windows GNU Clippy pass. Packaged unauthorized-invoke denial is not claimed. Linux pty_spawn capability authority is intentionally deferred to task 3.2.

Chained pull request context

• Previous PR: feat(platform): add target-aware desktop services #40, merged (PR5a/task 3.1a)
• Current PR: PR6/16 (PR5b/task 3.1b)
• Replaces: feat(platform): enforce Tauri command authority #42, closed without merge after this replacement is published
• Next PR: planned task 3.2 only
• Review this PR first: finite authority declarations, target capability parity, complete generated allow/deny contracts, and contract tests
• Intentionally out of scope: Linux pty_spawn authority, packaged-runtime unauthorized invocation denial, task 3.2, frontend integration, packaging, and all later work

Field	Value
Chain	Terminal AI platform expansion
Tracker PR	Not needed
Position	PR6/16 (PR5b)
Base	master at merged PR #40
Depends on	#40 (merged)
Follow-up	Task 3.2, including Linux pty_spawn authority
Review budget	288 authored / 400; 154 generated
Starts at	origin/master 0ac54b8 with PR5a merged
Ends with	Static/build-time least-privilege Tauri command authority

Chain overview

master
 └── #40 PR5a/task 3.1a (merged)
      └── 📍 PR6/16: PR5b/task 3.1b (this PR)
           └── Task 3.2: Linux pty_spawn authority and follow-up work

Scope

• Includes: static/build-time authority manifests, target capabilities, complete generated allow/deny contracts, and parity tests.
• Excludes: Linux pty_spawn capability authority, packaged-runtime denial evidence, task 3.2, and all later work.

Autonomy

• CI is expected to pass for this PR branch.
• This PR has one deliverable scope.
• This PR can be rolled back without unrelated changes.
• Tests cover this unit.

Rollback: revert commit 85ecd1c; this removes only the 19 authority-manifest paths/changes and preserves merged PR5a platform services.

Contributor checklist

• I searched for duplicate issues and pull requests before starting.
• I linked an approved issue using Closes, Fixes, or Resolves.
• I selected exactly one pull request type and applied exactly one matching type:* label.
• I completed every relevant template field and included reproducible test evidence.
• I updated documentation when behavior or compatibility changed, or documented why no documentation change is needed: internal authority contract only.
• My commits follow Conventional Commits.
• My commits contain no AI attribution, including Co-Authored-By trailers.