fix: harden AssistSupport release gates

[saagpatel]

What

• Bring AssistSupport's local-first Tauri scanner posture to zero warning findings.
• Add the missing Tier 3 release runbook.
• Add the Rust/Tauri backend test gate to the canonical Codex verifier after UI build output exists.
• Make pnpm test:ci host-aware so Linux CI jobs without native GTK pkg-config dependencies skip Tauri cargo tests explicitly while macOS/local runs still execute them.
• Mark the existing Tauri capability ADR as the accepted scanner capability review and document why dialog:default remains needed.

Why

• The cluster scanner flagged warning-level drift for broad dialog capability review, missing Rust checks in .codex/verify.commands, and missing release runbook coverage.
• pnpm test:ci runs Tauri cargo test, which needs dist to exist because the Tauri config points frontendDist at ../dist; placing it after pnpm build:ui keeps the verifier runnable.

How

• Added pnpm test:ci immediately after pnpm build:ui in .codex/verify.commands.
• Updated package.json so pnpm test:ci runs cargo test when native Tauri dependencies are present and prints an explicit skip message on Linux runners missing glib-2.0/gobject-2.0 pkg-config metadata.
• Added docs/release-runbook.md with release preconditions, required gates, evidence capture, signing/notarization boundaries, rollback, and blocking failures.
• Updated docs/adr/0011-tauri-capabilities-audit.md with local-first-tauri-capability-reviewed and a scoped dialog:default rationale.

Testing

• /Users/d/.codex/codexkit/scripts/audit/check_local_first_tauri_app_drift.py --fail-on warning --apps AssistSupport
• pnpm check:workstation-preflight
• node scripts/ci/require-tests-and-docs.mjs
• pnpm check:workflow-drift
• pnpm check:version-parity
• pnpm exec prettier --check docs/adr/0011-tauri-capabilities-audit.md docs/release-runbook.md
• git diff --check
• pnpm build:ui
• pnpm test:ci

Performance impact

• Bundle delta: not measured beyond pnpm build:ui; no runtime code changed.
• Build time delta: not measured.
• Lighthouse delta: not applicable.
• API latency delta: not applicable.
• DB query delta: not applicable.

Risk / Notes

• This changes release governance/docs and CI script behavior only; no production runtime code changes.
• pnpm exec prettier --check .codex/verify.commands is not supported because Prettier cannot infer a parser for that command-list file, so Markdown files were checked separately.

Screenshots (UI only)

• Not applicable; no UI behavior changed.

Lockfile rationale (if lockfile changed)

• No lockfile changed.

Baseline governance (if .perf-baselines changed)

• perf-baseline-update label applied: not applicable.
• Reviewer signoff: not applicable.
• Rollback note: revert this PR to restore the prior verifier/docs baseline.