WIP: Native bubble revamp and platform parity

[skb50bd]

WIP

This is the single draft integration branch for the native bubble revamp. It deliberately combines the current desktop guardrails, remote-SSH hardening, and durable-recovery work so their real interaction can be exercised before the bubble work is promoted.

Stack

Depends on #704, #705, and #708. The branch contains the current heads of all three PRs and the current upstream main (including #762), so the draft matrix tests their combined state rather than an old snapshot.

Scope

• Multi-session native bubble presentation with Open, Pin, Subagents, and Dismiss controls.
• Bounded presentation updates, native accessibility, render counters, and test-only Keychain isolation.
• Linux popup surfaces, activation, X11/Wayland interaction and performance smoke coverage.
• Windows canvas/input routing, native controls, context menus, dragging, notifications, and smoke coverage.
• Supporting Native SDK patches, documentation, and CI coverage.

Intentional boundaries

Desktop-native internals only: no public web API, database, or CLI contract changes. This draft does not claim to fully resolve #686 or #661. It references #703 but does not close it until the Windows input gates are green.

Validation

• git diff --check
• Fresh pinned Native SDK checkout: all required patches apply and the CLI builds.
• native build -Dcpu=baseline -Dtrace=off -Dautomation=true
• native test . — 406/406 passed on macOS.
• python3 tests/remote_watchers_test.py and all local Linux smoke-script self-tests.
• bun run check and bun run hooks:test.
• Workflow YAML and shell syntax checks.

The full X11, Wayland, and Windows interaction scenarios remain in this draft PR's platform matrix.

Size

• Bubble layer over the integrated dependency base: 39 files, +14,754 / −1,247 lines.
• Cumulative over current upstream main: 69 files, +21,630 / −1,608 lines.

Issues

Refs #686, #661, and #703.

[vercel]

@skb50bd is attempting to deploy a commit to the Crafter Station Team on Vercel.

A member of the Team first needs to authorize it.

[Railly]

@skb50bd all of your PRs are in draft, is that correct? if they're ready, could you set them ready for review?

[skb50bd]

done. Sorry about the oversight.

[skb50bd]

This specific PR is not ready yet. I need to fix one more glitch I am seeing
@Railly