M6: Desktop control-surface invoke bridge

[DeadWaveWave]

💡 Change Scope

• Small Change: Fast feedback, localized UI/logic, low-risk.
• Large Change: New feature, cross-boundary logic, runtime-risk (persistence, IPC, lifecycle, recovery).

📝 What Does This PR Do?

• Adds a Desktop IPC/preload bridge window.opencoveApi.controlSurface.invoke() backed by Main reading control-surface.json and invoking the local Home Control Surface /invoke.

Why:

• This is the foundation for finishing M6 Desktop entrypoints (endpoints/mounts/project/space mount semantics) without leaking control-surface tokens into the renderer.

---

🏗️ Large Change Spec

1. Context & Business Logic

• Renderer must be able to call Home Control Surface contracts (endpoint.*, mount.*, filesystem.*InMount, pty.spawnInMount, etc) while keeping credentials in Main.

2. State Ownership & Invariants

• Token never enters renderer; Main is the only owner of the Home control-surface token.
• Renderer only sends { kind, id, payload } intents.

3. Verification Plan & Regression Layer

• Contract/E2E will be added in follow-up commits in this branch once mount/endpoint flows are wired.

---

✅ Delivery & Compliance Checklist

• My code passes the ultimate gatekeeper: pnpm pre-commit is completely green.
• I have included new tests to lock down the behavior (or explicitly stated why it's untestable).
• I have strictly adhered to the DEVELOPMENT.md architectural boundaries.
• I have attached a screenshot or screen recording (if this touches the UI).
• I have updated the documentation accordingly (if adding a feature or changing a contract).

[DeadWaveWave]

Superseded by #159 (feat/m6-desktop-endpoints-mounts). Keeping M6 in a single PR per updated requirement.