feat(desktop): home app (system-only launch cap, LAUNCH_BADGE: apps+launch only), pm starts it with session (relaunch <=5); display keys F1/Alt+Tab next, F2 home, F4 close app (ROLE from launcher, terminal exempt), close returns to previous window; closed window -> app exits; shell 'name &'; launch by id; pm stack 8, storage 16 clients

crates/manifest/src/capability.rs

@@ -62,6 +62,7 @@ catalog! {
     // System-only (see `Capabilities::SYSTEM_ONLY`).
     Permissions = "permissions",
     Session = "session",
+    Launch = "launch",
 }
 
 impl Capability {
@@ -81,7 +82,7 @@ impl Capabilities {
     /// refused, so no prompt can talk a user into handing them over.
     /// `permissions`: changing what other apps may use. `session`: who is
     /// signed in, and signing out.
-    pub const SYSTEM_ONLY: Self = Self(1 << Capability::Permissions as u32 | 1 << Capability::Session as u32);
+    pub const SYSTEM_ONLY: Self = Self(1 << Capability::Permissions as u32 | 1 << Capability::Session as u32 | 1 << Capability::Launch as u32);
 
     /// As sent in a message word.
     pub const fn bits(self) -> u32 {