v0.4.3

Single-blocker follow-up to the v0.4.2 hotfix. No new features; one
correctness fix and one CHANGELOG link repair.

Fixed

• Tauri asset-protocol scope now matches the runtime data dir.
  v0.4.2 narrowed assetProtocol.scope to
  $APPDATA/perima/thumbnails/** but the runtime still resolved
  data_dir via directories::ProjectDirs which produces a
  different subtree than Tauri's $APPDATA (directories uses
  ~/.local/share/perima on Linux; Tauri uses
  ~/.local/share/dev.perima.desktop, based on the bundle
  identifier). Every convertFileSrc(thumbnail_path) returned 404 —
  the grid view showed broken placeholder tiles for every image on
  every platform. Fix: perima_desktop::run now resolves data_dir
  via app.path().app_data_dir() inside .setup() (new
  Config::resolve_with_app_data_dir entry point), with data_dir
  set to <app_data_dir>/perima so the existing scope literal
  matches. New regression test pins
  thumb_root.starts_with(app_data_dir) AND
  thumb_root.ends_with("perima/thumbnails").
• CHANGELOG [Unreleased] compare link was pointing at
  v0.4.1...HEAD after the v0.4.2 release; corrected to
  v0.4.3...HEAD.

Notes

• Runtime verification of the scope fix is deferred to user testing —
  no display available on the dev / CI machine. The regression test
  pins the path invariant but cannot exercise convertFileSrc end-
  to-end without a WebView.
• Follow-up for v0.4.0 / v0.4.1 upgraders: the V004 backfill (v0.4.2)
  flipped pre-existing thumbnail_status = NULL rows to 'pending',
  but rescanning unchanged files returns UpsertOutcome::Unchanged
  and therefore never re-enqueues them — those rows stay pending
  forever. Tracked as
  utof/perima#19;
  mitigation (retry command OR enqueue-on-Unchanged-AND-pending) will
  land in a later patch.