Desktop: lock down and test the packaged app

[priethor]

What

Follow-up to #397 and #403.

Embedded web content now gets only the Electron permissions Cortext needs. Fullscreen still works for HTTPS embeds, while access to the camera, microphone, screen capture, location, clipboard reads, and connected devices is blocked. Packaged builds also hide DevTools and disable unused Node and inspector entry points.

Buildkite now checks and opens the signed and notarized .app before uploading it. This verifies its security fuses and bundled runtime files, then checks startup, local runtime authentication, second-instance handling, and clean shutdown.

Why

Cortext loads web embeds inside Electron, so the app should grant only the permissions they need.

Our current E2E tests run Electron from source and cannot catch failures that only affect the packaged app. Signing and notarization do not prove that the .app starts, so CI should open it before uploading it.

How

• Serving loading and error pages through a private scheme so packaged builds do not need privileged file:// access.
• Connecting the packaged smoke test only to the renderer over loopback CDP, without enabling the Node inspector.

Testing Instructions

1. Install the macOS artifact from CI and open Cortext with a fresh profile. Confirm that the workspace and editor canvas load.
2. Open the View menu. Confirm that reload, zoom, and fullscreen are available, but "Toggle Developer Tools" is not.
3. Open an HTTPS video embed and enter fullscreen. Quit Cortext, reopen it, and confirm that it starts normally.

---

I used Claude to help implement these changes. I guided the work, then tested and reviewed the result.