Restore application access for third-party menus

[smillunchick]

Summary

Restore the app list for third-party menu plugins such as Omalaunch after the scoped plugin API change.

• Read panel manifests from the validated plugin registry, not the Qt model's converted copy.
• Forward iconIndexChanged through the app-library facade so menus can finish their icon-refresh cycle. This exposes a signal, not the private icon index.
• Add an offscreen Quickshell regression test for menu access, non-menu denial, and app/icon change signals.

Cause

Reproduced with Omalaunch 0.3.0 and omarchy-dev 4.0.0.r2071.ga703092-1. The current quattro branch has the same affected shell code.

computePanelEntries() accepts the menu manifest, then passes it through an Instantiator. Qt converts its nested kinds array to a sequence: it still serializes as ["menu","bar-widget"] and supports indexOf("menu"), but Array.isArray(modelData.manifest.kinds) returns false. manifestHasKind() then rejects the menu grant, and the injected PluginShellApi.appLibrary is null. The launcher shows an empty Apps menu even though desktop entries remain installed.

The fix keeps the existing capability checks and uses the registry's original validated object. It does not restore the full shell object or widen non-menu access.

Once the app library attaches, Omalaunch also needs its existing iconIndexChanged completion signal; without it, an icon refresh can stay pending indefinitely.

Validation

Passed:

• bash test/shell.d/panel-menu-capability-test.sh — real Qt model conversion, actual facade components, and the production binding/grant/signal code; works without a compositor.
• bash test/shell.d/plugin-auth-boundary-test.sh — static checks and QML runtime fixture.
• bash test/shell.d/plugin-registry-contract-test.sh — QML runtime fixture.
• bash test/shell.d/app-search-test.sh.
• git diff --check.

The new test first failed on the missing menu grant, then on missing icon completion after applying only the manifest fix. It passes with both changes. Existing authentication and ordinary-panel restrictions still pass.

The patched full desktop has not been visually verified. The installed, package-owned shell was left unchanged; no development link, permission change, migration, or release is included.

Companion fix

Omalaunch separately relies on the now-private manifest.__sourceDir for its helper paths. Its companion PR resolves the plugin directory from its own QML file: DanielLemky/omalaunch#58

Both fixes are needed to restore that launcher on the affected host.