feat(desktop): apply WebKit rendering workarounds at startup on Linux

[wpfleger96]

On some Linux GPU/driver/compositor combinations, WebKitGTK's dmabuf renderer aborts the web process during startup, so Buzz comes up with no window at all and the user has no way to fix it. Setting WEBKIT_DISABLE_DMABUF_RENDERER=1 avoids the abort by falling back to the shared-memory buffer path.

WebKit reads each of its rendering variables exactly once per process, so the choice has to be made before anything initializes — there is no runtime toggle and no second chance later in the same process. This decides up front from two cheap preflight signals rather than reacting to a crash:

• NVIDIA GPU — any DRM device under /sys/class/drm reporting PCI vendor 0x10de, the driver family behind most upstream reports.
• AppImage — the APPIMAGE environment variable. linuxdeploy's AppRun hook pins GDK_BACKEND=x11, and the dmabuf renderer buys nothing on that XWayland path.

Either signal disables the dmabuf renderer. Neither signal leaves the environment untouched.

Escape hatches

--safe-rendering forces the safest configuration for one launch — WEBKIT_DISABLE_DMABUF_RENDERER plus WEBKIT_DISABLE_COMPOSITING_MODE — for a machine neither signal recognises.

Any user assignment of a variable this module may set stands the heuristic down wholesale. Presence is the test, not truthiness, so VAR=0 and VAR= both count: a user asking for the dmabuf renderer on gets it, even on a machine the heuristic would have opted out. --safe-rendering against such an assignment is refused with a diagnostic naming both the assignment and the key to unset, and exits non-zero — the flag and the environment are two incompatible answers to one question, and neither is guessed.

Placement

webkit_rendering::apply() runs at the top of fn main(), before buzz_lib::run(). That is the only point where the process is still single threaded with no GTK object alive, which is what makes std::env::set_var sound; the module doc and the call site both say so. The whole module is #[cfg(target_os = "linux")] — macOS and Windows compile none of it.

The decision is a pure function of argv, an injected environment lookup, and an injected DRM root, so all of it is unit-testable without mutating the process environment.

Closes #2338. Upstream: tauri#9394. Same approach and same variable as clash-verge-rev workarounds.rs and screenpipe linux_webkit_env.rs.