fix(desktop): restore backups and align macOS titlebar for v0.2.1

[abraxas914]

Summary

This prepares GenericAgent Desktop portable v0.2.1 and fixes two regressions present in v0.2.0:

• Memory/session import and export were hidden because the renderer probed HEAD /memory/import/inspect, while the real aiohttp bridge returns 404 for that POST-only route.
• The React sidebar toggle used fixed CSS coordinates independent of the native macOS traffic-light geometry, so identical source could be misaligned when built against a different SDK.

Commit structure

1. fix(desktop): expose explicit backup capabilities
   • Adds GET /services/capabilities with dataBackup: true.
   • Adds a real aiohttp regression test that reproduces the HEAD 404 and verifies all three POST backup routes remain registered.
2. fix(desktop): align titlebar controls with native metrics
   • Adds a bounded, main-thread macOS command that measures native traffic-light geometry in webview coordinates.
   • Grants the command only to the main window.
   • Pins the release build to macos-26, Xcode 26.5 build 17F42, and macOS SDK 26.5, with a hard pre-build check.
3. release(desktop): prepare portable v0.2.1
   • Updates package, Cargo, Tauri, qualification, and provenance metadata to 0.2.1.
   • Refreshes the compiled renderer from fork commit e7bfb038b972c7cc5fda7134c777ef2df7ac222d.
   • Extends the compiled-only verifier to require the explicit capability, both backup entrypoints, and native titlebar metric markers.

The upstream repository boundary is preserved: this PR does not submit the fork's TypeScript source, E2E source, Vite configuration, or source lockfile. frontends/desktop/static/** and memory/** are unchanged.

Validation

• Fork source hotfix: PR #34, all 11 checks passed, including browser/native smoke and macOS titlebar geometry.
• Full local Python suite passed.
• Rust tests: 23 passed.
• Targeted bridge/release/security tests: 48 passed.
• npm run test:dist passed with 98 generated assets and manifest SHA-256 7e7f8c59fe84a5d1a49e6b7a4014aa320d3b1c458af7afeb2f78075946e153bc.
• Generated files are byte-identical to a clean build of the recorded fork source commit, excluding the upstream-authored README and provenance file.
• Full candidate workflow: run #33082210064, all three builders passed.
  • Windows SHA-256: 95c03fe8cda573c8b357722ba86a6dbeca9d0979c58a7399e46ab8bc23aa164e
  • Linux SHA-256: 153fa8d588e05833686d8346354c14e0a05fb480ef7163eacc42fe03a0ab8982
  • macOS SHA-256: 6ea3a3198fa952f4a25fbf937e41bcec48966a5db59c8fdb04510ff67ad752de
• The candidate DMG passed checksum, archive, ad-hoc signature, CFBundleShortVersionString=0.2.1, CFBundleVersion=0.2.1, and packaged bridge route inspection.

Release handling

After merge, create desktop-portable-v0.2.1 on the exact upstream merge SHA. The workflow publishes one prerelease only after all three builders succeed. Re-verify the official assets before changing that same Release to stable; do not move the tag or replace assets if verification fails.

[abraxas914]

Closing temporarily while we complete additional desktop v0.2.1 iterations. The fork branch and validated commits are retained; a reviewed final PR will be opened after the remaining changes and candidate validation.