Fix native window decorations

[Reddimus]

Summary

• Restores normal GNOME Wayland window controls by enabling winit's wayland-csd-adwaita-notitle feature, keeping the ab_glyph -> owned_ttf_parser -> ttf-parser advisory path out of the graph.
• Adds native titlebar theme syncing so Windows DWM / Wayland CSD follows Kettle's active light/dark theme instead of only the OS-wide preference.
• Fixes several verified audit findings: non-UTF-8 config persistence overwrite, Ctrl+Shift+Space keybind round-trip, padding snake_case validation drift, custom URL fallback, and multi-window pending run_command orphan detection.
• Updates RustSec handling: upgrades tauri-winrt-notification to remove the runtime quick-xml path and documents the remaining build-time Wayland scanner ignore.

Root cause

v2.33.1 turned off winit default features to scope RUSTSEC-2026-0192. That also dropped winit's Adwaita client-side-decoration feature. On GNOME Wayland, Mutter does not provide server-side window decorations, so winit fell back to smithay-client-toolkit's primitive fallback frame.

Validation

• just gauntlet-strict
• cargo build --release -p kettle
• target/release/kettle --screenshot target/diagnostics/native-decorations-offscreen.png --cols 100 --rows 30
• Live Ubuntu GNOME Wayland screenshot: target/diagnostics/native-decorations/window-frame.png showed normal Adwaita-style minimize/maximize/close controls.
• just live-render-smoke
• scripts/check-ttf-parser-scope.sh