feat: add the Control center and its decision registry

[ahilles107]

What

A Control center in the desktop app, backed by a decision registry in the daemon.

• A bot raises a decision with raise_decision; the owner rules on it in the Control center; the ruling is delivered to every bot that needs it and kept as a searchable record.
• A ruling a bot heard at its own terminal can be filed back with record_decision. It is marked as relayed until the owner confirms the words are theirs, and capped per bot so a bot cannot flood the record with rulings nobody has checked.
• The view: a waiting list, a reading pane, a composer, a publish tray, a settled registry and a tags panel, plus a sidebar row with a badge counting what the owner still owes.
• Tags are a real taxonomy: create, describe, colour, rename, merge (retire_tag … into) and hard-delete, with usage counts and a last-used stamp.
• approve becomes a real capability distinct from control, and devices can be granted it.

Protocol and architecture docs are updated to the shipped shape.

Why

A bot that needs the owner's call has nowhere to put the question today: it goes into a terminal nobody is watching, and the answer — when it comes — lives in one bot's memory file, where the next bot cannot find it and the owner cannot remember giving it. The registry makes that exchange durable and legible on both ends.

approve is split out of control because the registry's whole premise is that authority is legible. A credential that can start bots and send messages is not thereby the owner, and a ruling published from one would be indistinguishable from one they typed.

How tested

• pnpm verify green on this branch: cargo fmt/clippy -D warnings/cargo test --workspace --all-targets, the 400-line file check, the notices check, desktop and marketing checks and build, the Tauri crate, and the Ladle visual-regression suite in the pinned Playwright container (72 passed).
• New daemon integration tests: tests/decisions.rs, tests/decision_tags.rs, tests/decision_records.rs, tests/control_center.rs, tests/control_center_tags.rs, tests/decision_migration.rs — covering raise/publish/dedupe, relay confirmation and its cap, read-only vs control vs approve, cross-project refusals, and tag rename/delete.
• Desktop unit tests for the view's state, composer, keys, notify sets, reader scroll and publish plan.
• 24 new visual baselines generated in the pinned container; the one changed existing baseline is new-device-form--default, which now lists three capabilities because approve is grantable.

Notes

• third-party/DESKTOP_NOTICES.txt and inventory.json were regenerated under the pinned toolchain (rustc 1.98.1) for the two new dependencies, react-markdown and @tauri-apps/plugin-notification. mac-notification-sys ships no license file in its crate, so its upstream LICENSE-MIT / LICENSE-Apache are added as pinned overrides.
• Squashed from the work branch, which was based on the archived private repository and so shares no history with this one.