chore: Linux tray fix (supersedes #15), release version gate, lint CI, pasteboard test flake

[mtmatt]

Bundles four cleanups into one PR. It has two commits: style: run cargo fmt (pure rustfmt output; reproduce it by running cargo fmt on main) and the actual changes. To review just the changes, look at the second commit.

1. Port of #15 (supersedes it)

• Linux tray: tauri.conf.json's app.trayIcon already makes Tauri build a tray (id main) before setup() runs, and setup_tray then built a second tray with no icon. That second tray is what fails to build on Linux. Instead of giving the duplicate an icon, as fix: fedora user should be able to open the app now #15 did, setup_tray now looks up the config tray (tray_by_id) and attaches the menu and handlers to it. As a side effect, menuOnLeftClick: false now applies to the tray that has the menu: left-click toggles the popover and right-click opens the menu.
• Preferences… tray item (useful on Linux, which gets no tray click events). open_or_focus_settings is shared with the macOS app menu.
• Settings window closes normally. Only the main drop-zone window is hidden-to-tray.
• No console flash on Windows: new process::{async_command, sync_command} constructors set CREATE_NO_WINDOW, and every subprocess spawn in src/ goes through them. fix: fedora user should be able to open the app now #15 used a no_window! macro at each call site instead. The only exceptions are the Linux-only xclip/wl-paste calls.

2. Release version check

• scripts/check-version.sh [vX.Y.Z] checks that package.json, Cargo.toml and tauri.conf.json agree and that the tag, if given, matches them.
• release.yml now starts with a verify-version job. The build matrix waits for it (needs) and checks out the same tag, so manual workflow_dispatch runs also build the tag they name rather than the branch they were started from.
• build.yml runs the check on every push and PR.
• bump-version.sh no longer mentions the deleted auto-tag workflow.

3. Lint in CI

• cargo clippy --all-targets -- -D warnings is clean on macOS, Linux and Windows. Linux was checked in an aarch64 Docker container and Windows with the x86_64-pc-windows-gnu target in Docker; those platforms compile cfg-gated code that macOS never sees.
• Fixes are mostly clippy autofixes (collapsible ifs), gating macOS-only helpers to macOS, and targeted allow(dead_code) where code is per-platform on purpose (each is commented).
• build.yml now runs cargo fmt --check on Ubuntu and clippy on every OS in the matrix. AGENTS.md is updated to match.

4. Flaky clipboard tests

The macOS NSPasteboard integration tests share the system pasteboard and used to clobber each other under parallel cargo test. Each one now holds a poison-tolerant pasteboard_lock(). Plain cargo test passed 20 of 20 runs; before, most runs failed.

Testing

• cargo fmt --check passes, and cargo clippy --all-targets -- -D warnings is clean on macOS, Linux and Windows-gnu.
• cargo test: 99 passed / 1 ignored plus 2 end-to-end tests on macOS; 94 passed in the Linux container.
• Launched the app on macOS: setup, including the config-tray lookup, succeeds and the app stays up. CLI convert smoke test passes.
• check-version.sh exercised for matching versions, tag mismatch, file mismatch, and a tag without the v prefix.
• Not tested: the Windows runtime, the Linux GUI tray, and the GitHub Actions runs themselves (quota).

🤖 Generated with Claude Code