feat(notifications): add native macOS Dock unread badge

[wesbillman]

Current main sync: d2c6d70

Merged main at aed15028e1a212d909ff93999b72dd118e3fc1d6 without conflicts, bringing in the merged #110 browser scrolling-test fix and #72 thread-bottom fix. The badge feature diff against the new base is byte-identical to its previously reviewed diff. No new badge, permission, dependency or scope changes.

• Normal pre-commit and pre-push passed: staged formatting/lint, TypeScript, 102 related tests across 8 files, design types/guards. Remote head and clean working tree verified. All seven branch commits carry DCO sign-off; hosted DCO passed at this head.
• Fresh CI run 35652664814 is in progress at the post-push check. The failed browser results below belong to the old head, not this updated branch. No current-head green-CI claim.
• Required reviewer/code-owner approval and native macOS visible-badge/permission acceptance remain outstanding. PR readiness state was already non-draft before this sync and was left unchanged; this update is not approval or merge authorization.
• Native test/build results below retain their original snapshot attribution. No redundant native rebuild or GUI launch was performed for this conflict-free main sync.

Outcome

macOS only, per the owner's revised scope. Use Tauri's standard set_badge_label API for an OS-drawn, nonnumeric Dock badge representing observed unread activity or a manually unread channel in the selected community. No custom image assets.

The prior Windows taskbar overlay and Linux tray approach has been removed, including all seven artwork/source files, tray/menu owner, extra Linux Tauri feature and non-mac Settings/retry paths. Windows, Linux and browsers retain existing notification behavior, with no shell unread indicator, badge Settings, unread-projection binding or indicator IPC. No new Windows badge integration is included.

Ownership and scope

The existing bounded unread service remains the sole source of truth. The host owns one boolean projection and ordered native writer, not a count, new unread engine, relay subscription or storage owner. Account/community changes, access loss, read/manual intent and teardown clear or recompute the badge. Desktop alert preferences remain independent. The small FOUNDATION composition change was explicitly authorized.

macOS retains a narrow UserNotifications permission bridge because Tauri's official desktop notification permission methods do not query actual badge settings. Startup/focus/check are read-only. Explicit first setup requests Alert|Sound|Badge; explicit missing-badge setup on an already Authorized identity requests Badge only. Denied authorization and explicitly Disabled badges are never re-requested. Unbundled processes do not call UserNotifications. Automatic legacy-repair machinery from the original draft remains removed.

The remaining main-window-only setter is in dock.rs; there is no separate native cross-platform indicator module. Existing native banner delivery and focus code have no diff against main. No close-to-tray, background operation, new image loader, custom badge renderer, timer, notification backend or distribution work is added.

Previous feature validation at c8b94b6

• Full macOS buzz-foundation package suite: 17 passed, plus cargo clippy --locked -p buzz-foundation --all-targets -- -D warnings. The removed eighteenth test checked the now-deleted Windows/Linux image assets; macOS permission tests are retained.
• Normal pre-commit and pre-push hooks passed without bypass: staged Biome/rustfmt, TypeScript, 102 related tests in 8 files, and design types/guards. Remote head verified equal; worktree clean.
• Real unread/session tests preserve startup, message/thread arrival, read/manual intent, access deletion/loss, account/community switching and teardown. Ordered writer and late-permission tests remain. Added mounted Settings checks cover Windows/Linux/unknown/browser absence and no IPC; default-adapter tests retain non-mac banner delivery.
• Independent bounded source review found no material defect at this exact head, including non-mac gating, deletion completeness and preserved explicit-only macOS behavior. No browser journeys added or removed.
• Hosted CI at this head: JavaScript, Rust/tool integration, Windows native notifications, browser measurements, both journey shard 2s, security and DCO passed. Both journey shard 1s failed the same existing scroll-restoration assertion at tests/browser/layout.spec.mjs:636 (104 passed per failing shard); CI required is red. Run 35645857201. No scrolling code/tests changed in this PR; relationship has not been established by a base reproduction. No flake claim or blind rerun.

Remaining native acceptance gates

No native app was launched or OS permission changed for this revision; installed Buzz and the live account remain untouched. Still required for macOS:

• Isolated bundled identity: explicit first authorization, explicit missing-badge setup, denied/disabled preservation and legacy-banner compatibility.
• Visible Dock unread/read clearing, account/community/access switching, reload and exit.

Source review, unit tests and compilation do not prove visible Dock behavior. An isolated debug macOS bundle using this exact production head and a synthetic unread fixture now builds successfully. Its distinct test identity has not been launched, so it provides build evidence only. Attended first authorization, visible dot/clear, and opt-out checks remain pending; legacy setup and banner interaction require separate cases. Distribution signing and packaged-account support remain separate work. Windows/Linux shell unread support is deferred, not an acceptance gate for this narrowed feature.

Historical CI correction

A prior JavaScript job failed on five missing SVG accessibility titles outside the pre-commit file selector. Commit 5b1639d fixed the titles; the current macOS-only revision removes those assets entirely. The separate staged-SVG hook coverage gap remains deferred; it is not claimed fixed by deleting these assets.