[batteryshark]

Implements sections 3–6 of the 24 Oct 2026 Toolstack review as one release.

What changes

• Broker/SPS hardening, scoped idempotency, bounded approval summaries, admin and REST-forwarder fixes.
• Clear desk operator UI across web, desktop (pywebview) and the native Mac app; local development-signed Mac build.
• Hands-on test fixes: confirmation dialog buttons no longer overlap in the desktop window; the Mac app refreshes when active and every 20 s and re-checks a caller before Revoke/Rotate; double-click or Enter on a caller row opens its policy settings (web, desktop, Mac).
• Automated Chrome helpers use --use-mock-keychain and --password-store=basic.

Verified

• Full Python suite (1243 run, 0 failures, 16 skipped), Swift tests (83), offscreen WebKit checks (27 cases, 440 assertions), package build with isolated install.
• Installed-wheel full-stack run on macOS with fake data: broker, SPS, admin, one tool, fake Nod approval, admin restart and persisted-state recovery.
• Linux Docker and process-SPS functional run in a test VM.
• Secret scan of tree and history.

Known limits

• The Linux installer and systemd deployment are untested.
• Sign-out clears the session on that device only; the server does not revoke the session cookie or the Mac bearer token. GET /logout returns 405 by design; use the Sign out button. Server-side revocation is a follow-up hardening item.
• The Mac app is development-signed only (not notarized or distributed).
• Same-account Mac use is for development; secret isolation requires the dedicated Toolstack VM.