Integrate Snap runtime and native WebDesktop

[fwerkor]

Summary

• replace the Capbox/WebPanel application path with native WebDesktop backed by snapd
• run snapd on OpenWrt/procd through systemd-on-procd, eudev compatibility, persistent ArgosFS state, and required D-Bus/AppArmor integration
• backport AppArmor AF_UNIX mediation so strict Snap confinement is available on the CapOS kernel
• make snap.capos.top the sole client-facing Snap Store endpoint, including legacy Store APIs, assertions, redirects, payload URL rewriting, and R2-backed payload range caching
• preserve the existing Cloudflare Access protection for Store administration
• update CI, runtime smoke tests, documentation, and package dependencies for the Snap/WebDesktop architecture

Validation

• tests/webdesktop_frontend_smoke.sh
• tests/webdesktop_proxy_smoke.sh
• tests/webdesktop_runtime_config_smoke.sh
• shell syntax checks for AppArmor, D-Bus, and snapd init scripts
• website/snap: npm run test:worker
• website/snap: npm run check
• website/snap: npm run build
• strict-confinement QEMU validation during implementation, including installation and execution of the official strict hello-world snap

The Snap Worker is not deployed manually by this PR; the existing main-branch deployment flow will deploy it after merge.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	capos-snap	3844348	Aug 20 2026, 03:26 AM

[cloudflare-workers-and-pages]

Deploying capos with    Cloudflare Pages

Latest commit:	3844348
Status:	✅  Deploy successful!
Preview URL:	https://861d7a6f.capos.pages.dev
Branch Preview URL:	https://feat-snap-runtime-webdesktop.capos.pages.dev

View logs