fix(capabilities): drop unused opener plugin and greet template cmd

[saagpatel]

Summary

Audit of the Tauri capability + permission surface (ADR 0011). The model is already principled — no wildcard grants, no fs/shell/http plugins, every command explicitly allow-listed, and zero drift between the registered and permitted command sets. Two concrete dead-surfaces surfaced and are removed here.

Removed

1. greet template command — Tauri scaffold hello-world, zero callers from frontend or backend. Removed from registry.rs, permissions/default.toml, app_core_commands.rs, and the orphaned duplicate in commands/mod.rs. The build regenerates permissions/autogenerated/greet.toml (gitignored).
2. tauri-plugin-opener — registered in lib.rs and granted opener:default, but the only opener occurrence in source code is the unrelated HTML rel="noopener noreferrer" attribute. No call to openUrl or revealItemInDir. Removed the dep, the plugin init, and the capability grant. Cargo.lock shrinks by 178 lines of transitive deps.

Not changed (ADR 0011 captures as follow-up)

• 70 commands permitted but never invoked from production frontend (start_kb_watcher, has_hf_token, list_jobs, process_ocr, …). Each needs per-item verification before removal — some may be planned-but-unwired, some dead-from-deferred-features. Explicitly avoided to prevent the false-positive pattern flagged in prior audits.
• core:default sub-permission narrowing (tray, menu, image, window, webview appear unused). Defer until end-to-end UI regression can be verified.

Audit artifact

docs/adr/0011-tauri-capabilities-audit.md documents the methodology, findings, and the reproducible comm(1) script to re-run the audit on future commits.

Test plan

• cargo check --all-targets — clean
• CI backend-tests green (pnpm test:ci + security-regression)
• CI build green (pnpm tauri build succeeds without opener plugin)
• Manual smoke: app launches, dialog-based file pickers still work (Settings import/export), webview renders

🤖 Generated with Claude Code