feat(desktop): invoke exact external-app menu commands once

[iamnbutler]

Add desktop_menu to invoke one exact command in an external application's observed process generation. The literal title path is resolved afresh and must identify a unique enabled leaf before one AXPress. Missing, ambiguous, disabled, and unavailable lazy paths refuse before input; there are no ancestor presses, separate activation request, fallback, or automatic retry. macOS or the target app may still bring the app forward in response.

A signed accepted result proves delivery, not completion of the app's command. Ambiguous native returns stay unsafe unknown, and the existing process mutation lane remains held until the actual native call returns, including cancellation. Commands targeting the native Ace process itself are explicitly unsupported before input; read-only menu inventory remains available. Follow-up scope is tracked in #73 and #8.

Validation: real AppKit commands (including literal punctuation/Unicode and a modal), refusal cases, one real Anthropic model menu read/command in an Ace channel, and durable reopen by a distinct worker all passed. The reopen preserved tool history and usage without another native callback. The original external implementation is unchanged apart from content-free refusal diagnostics; the final integration adds only the own-PID refusal. On final head d1993fe173d097baa2c68edab3c381986fab9fdb, the own-PID check passed with a signed operation_unsupported refusal, dispatch_state: none, no dispatched units, and no new visible window. All owned runtimes exited; the port, socket, channel directory and isolated settings were clear, and the project catalog was unchanged. Types, formatting/lint, helper syntax, signed development build, strict signatures and GitHub CI passed.

Own-Ace delivery remains a follow-up: its experimental command returned signed unknown without an observed picker. Fresh read-only recovery and cleanup preserved that result without repeating input; the cause is unproven. The experimental route is removed. In-flight Stop/crash, hosted forwarding, and a second Mac were not exercised by this finite suite.

Built in Ace

Codex's file, shell, and native-runtime helpers were used to implement, review, build, and validate this slice under the user's explicit direct-tools exception for #8. Ace did not yet expose the menu command being implemented, and its self-menu route remains unavailable. The real model check ran through an Ace channel using the shipped tool boundary. These gaps are tracked in #8, #73, and the dogfooding meta issue #5.