fix: restrict privileged desktop IPC

[NeerajCodz]

Motivation

• Close a high-severity privilege boundary issue where the renderer could call arbitrary main-process IPC channels and supply unvalidated filesystem paths or terminal input.
• Limit attack surface by validating renderer origin and restricting file/terminal operations to the configured workspace root.

Description

• Add apps/desktop/src/main/security/ipc-security.ts with assertTrustedSender to validate IpcMainInvokeEvent origins and resolveWorkspacePath to canonicalize and enforce workspace path allowlisting.
• Thread the launch workspace root into IPC registration in apps/desktop/src/main/index.ts by passing launchCwd to registerFileIpc and registerTerminalIpc.
• Harden file IPC handlers in apps/desktop/src/main/ipc/file.ipc.ts to call assertTrustedSender and resolve all paths through resolveWorkspacePath before read/write/create/rename/delete/copy/move/stat/watch/open/reveal/open-terminal operations.
• Harden terminal IPC in apps/desktop/src/main/terminal/registerTerminalIpc.ts to call assertTrustedSender, validate cwd via resolveWorkspacePath, and preserve existing terminal request validations.
• Add focused tests at apps/desktop/src/main/security/ipc-security.test.ts that exercise resolveWorkspacePath allow/deny rules (including symlink escapes) and basic assertTrustedSender behavior.

Testing

• Added unit tests in apps/desktop/src/main/security/ipc-security.test.ts but running them in this environment failed because dependencies are not installed and vitest was not found (attempted bun --filter @orphix/desktop test -- src/main/security/ipc-security.test.ts).
• Performed repository checks including git diff --check which reported no whitespace/format errors and committed the changes as fix: restrict privileged desktop IPC.

---

Codex Task