feat(desktop-windows): cherry-pick yeedy features into upstream architecture + Windows CLI hooks support

[Yeedy]

Summary

Desktop Windows (Tauri v2)

Ports the yeedy fork's Windows desktop features into upstream's lean architecture (single-file lib.rs + ui/index.html), keeping upstream's file structure intact while adding:

• Deep link support: petdex://<slug> auto-activates/installs pets via single-instance lock + protocol registration
• Init banner: Shows "Run npx petdex init" when neither sidecar nor CLI is installed; click to copy command
• Update card: Polls update info, displays available updates, click-to-install via trigger_update
• Sidecar watchdog: Health-check every 5s, auto-respawn after 3 consecutive failures
• Auto-spawn sidecar: Starts sidecar on app launch via setup hook
• New Tauri commands: read_petdex_data, set_active, install_pet, set_mascot_state, trigger_update, respawn_sidecar, read_update_info, read_init_status, asset_url_for
• Config: 192x288 window (upstream size), bundle enabled (msi+nsis), CSP + assetProtocol, expanded capabilities

CLI Hooks — Windows Support

• Fixes Windows Claude Code hooks by generating a wscript.exe hidden launcher instead of POSIX shell commands.
• Persists petdex-hook.vbs alongside ~/.petdex/bin/petdex.js during hooks install/init.
• Adds an idle timeout when reading hook stdin so petdex bubble cannot hang if stdin is never closed.

Test Plan

• Verified locally on Windows that Claude Code tool events trigger Petdex mascot animation and bubbles.
• Verified the previous state.json / bubble.json no-op behavior is resolved after using the hidden hook runner.
• Desktop app builds and runs: pet displays, drags, shows bubbles, handles deep links.
• GitHub Actions passed.

Comparison with upstream

What this PR adds vs. upstream main

Feature	upstream	this PR
Deep link (petdex://)	❌	✅
Single-instance lock	❌	✅
Init banner (uninstalled state)	❌	✅
Update card + click-to-install	❌	✅
Sidecar watchdog + auto-respawn	❌	✅
Auto-spawn sidecar on launch	❌	✅
set_active / install_pet / asset_url_for commands	❌	✅
Windows CLI hooks (VBS hidden runner)	❌	✅
stdin idle timeout in bubble runner	❌	✅
read_file_as_base64 sprite loading	✅	✅ (retained)
192x288 window size	✅	✅ (retained)
CSS sprite animation (9 states)	✅	✅ (retained)

Architecture choice

This PR keeps upstream's lean architecture (single lib.rs + ui/index.html, no Vite build step) rather than the yeedy fork's modular Vite setup. The desktop-windows-yeedy branch preserves that original implementation for reference.

Known limitations

• A brief console flash may still occur from Claude Code's outer hook runner on Windows; this change fixes the Petdex hook command itself and prevents the Node child from hanging.
• Momentum drag, pet picker menu, and agent avatar bubbles exist in the yeedy fork but are not included here (can be ported from desktop-windows-yeedy if needed).

[vercel]

Someone is attempting to deploy a commit to the Crafter Station Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

I’ll review using the GitHub CLI diff as the source of truth and avoid executing or checking out PR code.
The PR is focused on Windows desktop/Tauri and CLI hook changes. I’m going to inspect the full GitHub-provided diff plus only the relevant base-side files for context.
[blocking] postcss.config.mjs:1 deletes the root PostCSS config that wires @tailwindcss/postcss. The main Next app imports Tailwind v4 directives from src/app/globals.css, so removing this config will leave the web app without generated Tailwind CSS or can break next build. This desktop PR should not remove the root config.

[important] packages/petdex-desktop-windows/ui/index.html starts init/update polling only after get_active_pet() succeeds. In a fresh install, get_active_pet() can return null, then boot() returns before pollInitStatus() ever runs, so the new “Run npx petdex init” banner never appears in the uninitialized state it is meant to handle. Start init polling before the pet lookup or call pollInitStatus() on the no-pet path.

[important] Cold-start deep links are not handled. The only place that emits petdex:deep-link is the single-instance callback in lib.rs, and the UI only listens for that custom event. If Windows launches Petdex from petdex://slug when no instance is already running, there is no code reading the initial deep-link URL, so activation/install is skipped. Use the deep-link plugin’s current/open-url handling during startup as well as the second-instance path.

[important] set_active() rejects pets that the existing loader accepts. load_pet_from_dir() treats pet.json as optional and accepts spritesheet.webp, spritesheet.png, sprite.webp, and sprite.png; the new set_active() requires pet.json and only checks spritesheet.webp/png. Deep-link activation will fail for valid installed pets with missing metadata or legacy sprite filenames, then incorrectly fall through to reinstall. Reuse load_pet_from_dir()/find_valid_sprite() here so activation matches normal pet discovery.

[github-actions]

[blocking] packages/petdex-desktop-windows/src-tauri/tauri.conf.json:32 sets script-src 'self', but the desktop UI still boots from an inline <script type="module"> in packages/petdex-desktop-windows/ui/index.html:130. That CSP will block the boot script, so the mascot UI will not initialize. Either move the script to a separate bundled file covered by 'self', or allow/hash/nonce the inline script.

[important] packages/petdex-desktop-windows/ui/index.html:1526 only handles deep links by reading new URL(url).hostname as a single slug. Existing repo helpers generate batch install links as petdex://install?slug=a&slug=b in src/lib/petdex-desktop-link.ts:23, so those links will try to install/activate a pet literally named install and ignore all requested slugs. The handler should branch on the install host and process the slug query params.

[important] packages/petdex-cli/src/hooks/bubble-runner.ts:66 adds an idle timeout, but finish() only resolves the promise; it does not pause/destroy stdin or remove listeners. If the Windows hook host keeps stdin open, the Node process can still remain alive after the promise resolves, and the new VBS launcher waits with shell.Run cmd, 0, True. Please close/pause stdin in finish() so the timeout actually prevents hook hangs.