feat(desktop): expose native Driver calls and screenshot URLs

[jmgilman]

Change

• Implement desktop.info, desktop.enable, desktop.call, and desktop.screenshot over the persistent guest Cua Driver daemon. Preserve native tool names, schemas, tokens, and results; use one-shot CLI requests through Incus exec.
• Execute as the automation user in its X11 session, include desktop readiness in create/wait, and report the actual VNC endpoint.
• Fetch PNGs through the binary Incus file API. Return short-lived HTTP URLs only, with bounded image/store bytes, expiry and sandbox-reaper cleanup, safe PNG dimensions, and optional resizing.
• Support the HTTP MCP handler and a separate screenshot listener for stdio.
• Authenticate private native Incus image pulls with image-access secrets. Resolve VNC forwards through DHCP leases when rebooted guests temporarily lack observed NIC addresses.
• Qualify catalog desktop VMs by their declared capability: X11, the active automation-user Driver service, and native list_apps. Preserve router/runner checks and apply the desktop catalog CPU/memory defaults.

Verification

• mise exec -- moon run root:check passed: 13 tasks, including build, tests, lint, formatting, docs, and offline CLI/MCP smoke; two tasks used Moon cache.
• Reproduced the old catalog bug against the published image: initialization failed at systemctl is-active incus-gh-runner-guest.path with exit 4 (68.06 s).
• The corrected TestDesktopAcceptance passed with the complete catalog from feat(images): promote qualified lab image digests #27 and no GHCR credentials: 182.26 s overall, 26.822 s for the representative program. It exercised real stdio MCP, private OVN networking/router NAT, Incus exec, and HTTP PNG fetching.
• One native foreground token click changed one document into two document tabs, verified independently by a fresh accessibility tree and fetched before/after PNGs. The Driver reports effect: unverifiable; the server does not invent success or retry ineffective background delivery.
• Reboot restored Driver readiness and the advertised VNC endpoint (10.10.40.67:5900, RFB 003.008). The running reaper made the screenshot URL return 404 21.773 s after sandbox expiry.
• Disposable probe programs were removed. Contract regression tests and pinned native fixtures remain. Detailed build measurements, native timings, earlier local runs, and published acceptance are recorded in spikes/desktop/README.md.

Published image and related work

• Image feat(images): build and qualify the Ubuntu X11 desktop VM #25 is merged; protected bake 34872818589 built, boot-qualified, published, and fetched back all four images.
• Desktop: ghcr.io/gilmanlab/agentcompute/ubuntu-24.04-desktop@sha256:5dc4e120a79dd06ad6784e69474f0617387f74cb98685af8844170b7165ea8e2.
• Published desktop measurements: 403.364 s assembly; 505,216 KiB peak RSS; 7,620,071,424 B sampled scratch high-water; 742,923,264 B qcow2. Complete desktop publication pipeline: 674.806 s.
• Cua Driver 0.28.1 is a prerelease, used under the explicit user-approved exception and full-archive SHA pin. The new private bake is not claimed to carry the older hosted pipeline's attestations.
• Generated catalog feat(images): promote qualified lab image digests #27 remains unmerged. Merge this server PR before feat(images): promote qualified lab image digests #27: the old server rejects desktop catalog qualification.
• Approved live OVN ENOSPC recovery and durable prevention: GilmanLab/fleet#20; central recovery runbook: docs(ovn): document evidence-first log and trust recovery root#34.
• Leave this PR, feat(images): promote qualified lab image digests #27, fleet#20, and root#34 unmerged as requested.