feat(commands): establish desktop client command bindings

[andrexibiza]

PR 5 — Desktop client binding seam

This is the independently landable Desktop slice under #96692. It introduces the execution-only projection that lets Desktop contribute genuinely client-owned actions, pickers, and dedicated RPC bindings without becoming another semantic command registry.

Exact object

• Base/current-main parent: 4209d371aa1bb8840ce8447555bdd863a1a96c38
• Head: 9a23b4951d6bfae7a57d59a99e1643dcf16e7293
• Tree: 9db5fe6e45d1628522e9d2d1ee9bef71d6df4eef
• One surviving commit; two added files; current main is the direct parent
• DCO trailer: Signed-off-by: Axl Ibiza, MBA <andrexibiza@gmail.com>
• CI 33269223135 — SUCCESS
• Docker 33269222838 — SUCCESS
• Nix 33269222850 — SUCCESS

Changed paths

• apps/desktop/src/lib/desktop-command-bindings.ts
• apps/desktop/src/lib/desktop-command-bindings.test.ts

Contract

• Projects only Desktop-owned action, picker, and dedicated rpc surfaces.
• Server-executed, unavailable, and unknown commands produce no client binding and therefore cannot be silently re-owned by Desktop.
• Accepts stable command_id from commands.catalog.v2.
• Uses the canonical slash name only as the explicit mixed-version fallback for older catalog peers.
• Resolves aliases through the existing canonical Desktop resolver; no second alias table is introduced.
• Binding objects contain execution ownership only: commandId, canonicalName, and surface. Catalog description, aliases, argument semantics, visibility, availability, and policy remain server-owned.
• Duplicate stable ids and duplicate canonical projections fail closed instead of allowing row order to choose an execution owner.
• Bindings, surfaces, and projected collections are immutable.

Repair / release-object reconciliation

The original submitted head 601ac5f54238b4d42e5be153872114393ba5270b was red in the JS/TS workspace checks. The defect was the named-import order in the new Desktop binding module under the repository's perfectionist/sort-named-imports rule. Rather than stack a green fix on a surviving red commit, this PR was rematerialized as the single current-main commit above with the import ordering corrected and product behavior unchanged. Exact-head JS/TS checks are now green inside CI 33269223135.

Collision / provenance scan

#96791 remains the merged current-main owner of registry-backed Desktop catalog metadata and dynamic command projection. This PR composes with that work and does not edit desktop-slash-commands.ts, the composer dispatcher, the Python registry, or the gateway dispatcher. The two submitted paths are disjoint from sibling command slices #97129 and #97143.

Focused characterization

The test suite covers the complete current Desktop-local surface (14 actions, 2 pickers, 2 RPCs), stable-id and v1 fallback behavior, alias canonicalization, server/unavailable refusal, RPC parameter preservation, immutable settlement, blank-id rejection, duplicate-id rejection, and duplicate-canonical rejection.

Refs #96692

[Enough1122]

AI code review — automated review for reference; please use your judgment.

Overall: Introduces desktop client command binding projection for catalog v2/mixed-version peers.

What it does

• New apps/desktop/src/lib/desktop-command-bindings.ts provides projectDesktopClientCommandBindings + resolveDesktopClientCommandBinding mapping catalog identities (command_id/name) to client-owned surfaces (action/picker/rpc), canonicalizing aliases via existing resolver, enforcing immutability (Object.freeze), and failing closed on command_id or canonical collisions and blank command_id.
• Covers 18 local commands (14 action + 2 picker + 2 rpc), uses command_id from v2 and canonical name fallback.
• Tests in desktop-command-bindings.test.ts verify projection length, alias canonicalization, non-claim of server commands (/usage, /clear), RPC param building, immutability, and collision guards.

Non-blocking notes

• STS LOCAL_COMMANDS list is hard-coded in test; if catalog grows, test's toHaveLength(18) will need updating — consider deriving expected length from source of truth or asserting >=.
• resolveDesktopClientCommandBinding throws on blank command_id — callers must handle; failing closed is intended.

Well-structured, tested, no issues.

Non-blocking — please use your judgment.

[andrexibiza]

Closure repair complete on exact 9a23b4951d6bfae7a57d59a99e1643dcf16e7293.

I fixed the JS/TS failure in the submitted Desktop binding (perfectionist/sort-named-imports) and rematerialized the PR as one commit directly on current main@4209d371aa1bb8840ce8447555bdd863a1a96c38 instead of leaving the previously red commit in the surviving train. Product behavior is unchanged; the two submitted paths remain the bounded Desktop client-binding seam.

Exact hosted receipts on the one surviving commit:

• CI 33269223135 — SUCCESS, including JS & TS checks / JS & TS checks and All required checks pass
• Docker 33269222838 — SUCCESS
• Nix 33269222850 — SUCCESS

GitHub reports the PR open, non-draft, and mergeable. The PR body has been refreshed to the exact base/head/tree and green execution receipts. No review was submitted on my own code.