feat(desktop): add guided capture and compare workflow

[XiaojuCH]

Summary

• add the first guided Tauri 2 + React desktop workflow: Start capture → make a change → Finish & Compare
• reuse the existing Rust Registry startup/Windows Services capture, coverage-aware Diff, and report semantics in-process
• add a versioned locale-neutral presentation DTO, backend-owned ephemeral session storage, and five no-argument capability-scoped IPC commands
• provide maintained en-US and zh-CN UI, a real Windows dogfood screenshot, source-build documentation, dependency updates, and desktop CI

Closes #13.

Product and security boundaries

• production remains local-only, read-only, non-elevated, and without telemetry or network clients
• the frontend receives no filesystem paths or Snapshot JSON and has no shell, filesystem, HTTP, dialog, opener, updater, or Registry/service write command
• unredacted temporary evidence stays under a bounded backend-owned app-local session root with create-new writes, conservative recovery, and exact verified cleanup
• Snapshot/Diff v1, Collector behavior, the CLI workflow, and the existing portable CLI artifact contents are unchanged

Local validation

• root Rust fmt and Clippy with -D warnings: passed
• root workspace tests: 119 passed
• frontend TypeScript check, ESLint, and Vite production build: passed
• locked npm audit: 0 vulnerabilities at every severity
• desktop Rust fmt and Clippy with -D warnings: passed
• desktop Rust tests: 16 passed
• Tauri Windows --no-bundle release build: passed; PE32+ Windows GUI subsystem verified
• CLI human/JSON/Collector smoke tests and existing portable package/download-style verification: passed
• Markdown relative-link, sensitive-path/secret-pattern, dogfood-script parse, and git diff --check: passed

Real Windows dogfood

A real release GUI session completed the product path without PowerShell, JSON, a file picker, or manual Snapshot names: GUI Start capture → separately gated synthetic HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run value SystemDiffDogfood → GUI Finish & Compare. The Results view classified exactly one Added startup entry, showed the exact synthetic command and location, showed no observed Service configuration changes, and preserved the partial Services coverage notice. Exact-data guarded Registry cleanup succeeded, the value was confirmed absent, and no session directory remained. The production desktop binary contains no write API.

Independent review reports no remaining High or Medium findings.

Intentionally deferred

Desktop installer/bundle and artifact distribution, Authenticode signing, clean-machine WebView2 bootstrap, history/import/export, updater, Scheduled Tasks, rules/risk, redaction/sharing, and additional Collectors remain out of scope.