feat(v1-removal): Phase 3.7h — collapse window-* fallbacks to strict tile:window:* only
Tile-preload's api.window.* methods previously had a per-call dual
path: strict `tile:window:*` if the tile declared a `window`
capability, else legacy un-gated `window-*` IPC. The fallback was
the last unrestricted access path to window operations from any
tile, including those that hadn't declared the capability.
Audit: every renderer caller of api.window.* either has the right
window subcap or is trustedBuiltin. The one feature that would have
broken (widget-demo's bookmarks widget calling api.window.open) now
declares `window: { create: true }`.
- tile-preload.cts: drop the `hasWindowCapability()` helper and every
fallback branch in api.window.{open, close, getInfo, list, exists,
show, hide, focus, setIgnoreMouseEvents, center, centerAll,
maximize, fullscreen, setOverlayFocusTarget,
setVisibleOnAllWorkspaces}. Every call now routes unconditionally
through the strict tile:window:* handler.
- ipc.ts: delete the 13 legacy `window-*` ipcMain.handle() registrations
(window-open, window-close, window-hide, window-show, window-focus,
window-exists, window-list, window-center, window-center-all,
window-maximize, window-fullscreen, window-set-ignore-mouse-events,
window-set-overlay-focus-target). The `windowOpenHandler` function
body stays — the strict tile:window:open handler in tile-ipc.ts
delegates to it via the exported `invokeWindowOpen` reference.
- features/widget-demo/manifest.json: declare `window: { create: true }`
so its bookmarks widget can still call api.window.open.
Build green, unit tests 588/588.