fix(desktop): port upstream Linux secret storage backend fix (Hyprland/Niri)

[shuv1337]

Why

Pairing an environment from the desktop app on this Hyprland host fails with:

Could not register connection: ConnectionTransientError: Could not save the local connection catalog: Desktop secure storage is unavailable in this system context.

Chromium selects the Linux keyring backend from XDG_CURRENT_DESKTOP and only recognizes a fixed set of desktops. On Hyprland/Niri/Sway it silently falls back to basic_text, and Electron's safeStorage.isEncryptionAvailable() then reports false (plain-text use requires an explicit opt-in) — even though GNOME Keyring is running with org.freedesktop.secrets on the session bus. DesktopConnectionCatalogStore.set correctly refuses to persist without encryption, so pairing dies.

Verified at runtime on this host with the packaged Electron (41.5.0):

without flag:                     {"backend":"basic_text","available":false}
--password-store=gnome-libsecret: {"backend":"gnome_libsecret","available":true,"roundTrip":true}

What

Ports upstream pingdotgg#2916 (6f04a5cff, merged upstream) onto the fork:

• Pre-ready backend selection (DesktopPreReadyPlatform + DesktopEarlyElectronStartup + linuxSecretStorage): before Electron emits ready, force --password-store=gnome-libsecret for sessions Electron would leave on basic text; leave recognized GNOME-family/KDE desktops alone; honor an explicit linuxPasswordStore desktop setting (auto | gnome-libsecret | kwallet | kwallet5 | kwallet6) and never override a user-provided --password-store switch.
• Login-shell session import (DesktopShellEnvironment): prefer XDG_CURRENT_DESKTOP/XDG_SESSION_*/DBUS_SESSION_BUS_ADDRESS from the login shell and derive a /run/user/<uid>/bus fallback, so launcher-inherited stale values don't mislead backend selection.
• Observability: startup logs the configured password store pre-ready and the selected safeStorage backend after ready.
• Remediation copy (resolveLinuxSecretStorageUnavailableMessage): GNOME Keyring vs KWallet wording, exported for the follow-up error surface as upstream wires it.

Fork adaptations

• Rebranded identifiers: @t3tools → @shuv2code, T3CODE_HOME → SHUV2CODE_HOME, ~/.t3 → ~/.shuv2code, wm classes/messages.
• Kept this fork's scheme privileges and moved its existing synchronous registerDesktopSchemesAsPrivileged() from main.ts into the new pre-ready layer instead of adding upstream's duplicate registration (Electron allows only one call).
• Dropped upstream's linuxApplicationsDir hunk (belongs to un-merged fix(desktop): Include standard Linux AppImage icons for Niri/Noctalia pingdotgg/t3code#2915).

Verification

• 102 focused desktop tests pass across the touched files (linuxSecretStorage, DesktopEarlyElectronStartup, DesktopPreReadyPlatform, DesktopConnectionCatalogStore, ElectronApp, ElectronProtocol, DesktopEnvironment, DesktopAppSettings, DesktopSavedEnvironments, DesktopShellEnvironment, and mock-updated suites)
• tsgo --noEmit and vp lint clean for the desktop scope
• Electron runtime probe on the affected Hyprland host proves the flag flips basic_text/unavailable → gnome_libsecret/available with an encrypted round-trip