fix: harden Desktop wallet and agent boundaries

[KillerQueen-Z]

Summary

• make Desktop workspace, shell, Detach, and Polymarket money approvals authoritative even with persisted CLI allow rules
• canonicalize tool aliases and schema-coerce inputs before permission and TradePlan checks
• disable paid prefetch in Desktop/hosted modes and enforce a non-bypassable hosted session spend ceiling
• bind the packaged backend to an OS-assigned loopback port and hand the actual port to Electron over authenticated IPC
• restrict local media serving to signed URLs, approved roots, and safe media types
• fail closed for Jupiter and Base 0x live swaps until complete local transaction/EIP-712 validation exists; keep read-only quote tools available

Security rationale

Jupiter and 0x responses supplied transaction bytes, allowance spenders, or EIP-712 payloads that were signed locally without independently binding them to the exact approved asset movement. This patch prevents those signing paths from reaching wallet or network access.

Validation

• npm test: 660/660 passed
• Desktop typecheck: passed
• Desktop lint: passed
• Desktop production build: passed
• macOS arm64 DMG packaging: passed
• fail-closed regression tests cover direct calls with auto_approve:true and assert no network access

Security scan: one additional high-severity 0x transaction-integrity finding validated and remediated. Scan coverage was risk-prioritized/partial because TAC and fresh worker slots were unavailable.