feat(platform): enforce Tauri command authority

[decode2]

Preflight checks

• I searched open and closed issues and found no duplicate.
• I understand a maintainer must add status:approved before work begins or a pull request is opened.

Problem

Desktop commands currently lack a checked-in, target-specific least-privilege Tauri authority boundary. Without static capability manifests and generated command permissions, command registration can drift from the authority granted to Linux and Windows windows.

Proposed solution

Add Linux and Windows capability manifests, a finite terminal permission set, generated allow/deny command permissions, build-time authority generation, and contract tests that enforce exact parity between registered handlers, manifests, and capabilities. This issue covers static and build-time authority only. Packaged-runtime unauthorized invocation denial is deferred to a later task.

Affected area

Desktop backend (Rust)

Alternatives considered

Relying on implicit/default Tauri permissions would be less explicit and would not provide target-specific, testable command authority. Runtime denial testing alone would also omit the checked-in build contract and is intentionally deferred.

Additional context

This is PR5b/task 3.1b in the terminal AI platform expansion chain. Task 3.2 and later work are explicitly out of scope.