fix(desktop): enforce exact Wails tool version

[gnanirahulnutakki]

Summary

• align the desktop Wails CLI pin with the existing go.mod requirement at stable v2.13.0
• replace substring matching with an exact, fail-closed version verifier
• add 12 adversarial policy assertions to the standard script gate
• record the decision, security boundary, upstream release, and validation evidence

Security, operations, and cost

This prevents prerelease, vendor-suffixed, malformed, missing, or failed tool probes from satisfying the desktop build gate. It adds no runtime dependency, permission, service, network path, storage, or recurring cloud cost.

Verification

• exact parent: 9e135de08cab047386b0a948311e7443e2741404
• shellcheck hack/verify-wails-version.sh tests/scripts/wails_tooling_policy_test.sh
• bash tests/scripts/wails_tooling_policy_test.sh (12 assertions)
• real checksummed Wails v2.13.0 CLI and signed arm64 desktop bundle
• go mod verify
• govulncheck ./...
• make ci
• make e2e-isolation plus 100,000 fuzz executions
• make release-check
• make e2e-kind KIND=/Volumes/EXTENDED/MacData/tools/bin/kind
• README reviewed; the documented make desktop-build workflow is unchanged

Upstream primary source: https://github.com/wailsapp/wails/releases/tag/v2.13.0

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bd56928d-ad44-4999-b4ed-6668591061e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/wails-policy-20260721

---

_{Comment @coderabbitai help to get the list of available commands.}