feat(serve): desktop-app CORS + self-heal beacon re-arm and forcelist reconcile

[MichaelTaylor3d]

Draft — WIP (cap insurance). Single dig-node family lane.

Closes #669 #651
Refs #584

Scope

• #669 (user priority): widen the loopback serve-surface CORS to desktop-app origins (Tauri) + expose X-Dig-Verified/-Root/-Inclusion-Proof/-Chunk-Lens so dig-urn-resolver's browser node-first path can read the verification attestation.
• #584: always-on driver re-arms the beacon schedule (dig-updater schedule ensure) on startup + a 6h tick, resolving the dig-updater binary absolutely from the admin-only #565 install root.
• #651: same-tick ext-forcelist channel-follow reconcile (recover a post-remove-failure uninstall), idempotent + best-effort, absolute sibling-exec.

Status

WIP. Privileged/serve-surface parts go through the dual gate + loop-security before merge. SYSTEM.md CORS/expose-header coherence flagged for the orchestrator.

🤖 Generated with Claude Code

[MichaelTaylor3d]

Loop merge-gate: CHANGES-REQUIRED (loop-security HIGH, §565-class LPE) — fix incoming, do not merge.

Triple gate: loop-reviewer PASS + adversarial CONFIRMED-SAFE (both flagged the item as non-blocking), but loop-security escalated it to a gate-blocker:

• HIGH LPE — self_heal.rs:103 windows_owner_is_privileged spawns powershell by BARE NAME. Windows program search resolves a bare name against the application directory (current_exe() parent = the install root) at step 2, BEFORE PowerShell's real location (reached only via PATH at step 5, since powershell.exe lives in System32\WindowsPowerShell\v1.0\, not System32 directly). So on a user-writable install root — the exact condition resolve_privileged_sibling_in exists to REFUSE — a low-priv user plants <root>\powershell.exe, and the next self-heal pass runs it as SYSTEM before the owner check that would return UserWritableRoot. The LPE gate undoes its own guarantee ("never a bare name", self_heal.rs:23).

Fix (dispatched): replace the powershell owner-probe with the Win32 security API (GetNamedSecurityInfoW owner SID → compare well-known SIDs S-1-5-18 SYSTEM / S-1-5-32-544 Administrators) — no spawn, which also removes the name-suffix owner check (adversarial's ends_with("\administrators") note → SID-equality instead) AND the blocking-spawn robustness concern. Mirror dig-installer's proven pattern (secure.rs, #584/#565). + a regression test: user-writable root with a planted powershell.exe must NOT execute it.

Everything else CLEAR (CORS read-only widening, 10 X-Dig-* expose headers are public metadata, WS/CSWSH path unbroadened, env provenance admin-only, sibling resolution absolute + TOCTOU-closed). Non-gating follow-ups (per-child spawn timeout; Tauri-origin wallet-read exposure) → separate tickets.