Reduce Tauri capabilities to least privilege

[dremnik]

Summary

The default capability grants broader plugin and core access than the Gate 0 spike uses. The opener plugin is registered but unused, and dialog:default enables save and message commands in addition to directory selection.

Evidence

• src-tauri/capabilities/default.json grants core:default, opener:default, and dialog:default.
• src-tauri/src/lib.rs initializes the opener plugin.
• No current frontend code imports @tauri-apps/plugin-opener.
• build.removeUnusedCommands is not enabled.

Proposed change

1. Remove the opener plugin and JavaScript/Rust dependencies until system-open behavior is implemented.
2. Replace plugin and core default permission sets with the individual permissions exercised by the main webview.
3. Enable build.removeUnusedCommands after the ACL is explicit.
4. Add a lightweight check that generated capabilities contain no unreviewed defaults.

Acceptance criteria

• The opener plugin is absent until a feature needs it.
• The main capability contains only individually reviewed permissions.
• The current workspace picker, event listener, and drag/drop flow still work.
• build.removeUnusedCommands is enabled and the packaged application passes its smoke test.

References

• https://v2.tauri.app/reference/acl/core-permissions/
• https://v2.tauri.app/concept/size/