refactor(macos): replace liquid glass with native menu vibrancy

[Harry19081]

Problem

The macOS window material depends on tauri-plugin-liquid-glass, which brings in the legacy cocoa -> block 0.1.6 dependency chain and Cargo's future-incompatibility warning. Its macOS 26 private glass variant and older-system fallback also use different material implementations. The requested replacement is Codex-style native Menu vibrancy that remains available across supported macOS versions.

Solution

• Use public NSVisualEffectView APIs through the existing objc2 bindings: Menu material, behind-window blending, native autoresizing, and window-following active state. No macOS 26-only API or undocumented corner-radius selector is used.
• Keep one identified material subview owned by its window's content view. Repeated enable reuses it, disable removes it, and window destruction releases it. Native window lookup and mutation complete synchronously on the main thread; no registry, timer, or observer is added.
• Preserve the existing startup cover, main-window recovery, detached-session setup, and external-page opaque background toggles. Existing CSS tint, wallpaper, opacity settings, Windows behavior, and IPC signatures are unchanged.
• Remove the plugin's two manifest entries and initialization. The lockfile removes seven packages (tauri-plugin-liquid-glass, block, cocoa, cocoa-foundation, objc, dispatch, malloc_buf) without adding or upgrading packages or changing retained checksums.
• Document compatibility, ownership, validation limits, and rollback in docs/architecture/macos-window-material.md.

Potential risks

The native surface visibly changes from AbuttedSidebar glass to Menu vibrancy and follows window activity. This matches Codex's native material choice, not its exact CSS appearance or its explicit unfocused/large-window opaque policy. Light/dark appearance, Reduce Transparency, clipping, resize/fullscreen, external displays, repeated toggles, startup/recovery, detached windows, and external-page navigation still need runtime visual verification.

The API availability checks below do not mean the app was run on every macOS release. No native UI was launched or controlled, in accordance with the user's explicit opt-in requirement for desktop control, so screenshots and runtime performance measurements are absent. The existing transparent-WKWebView private API configuration remains; the new material itself uses public APIs.

No deployment minimum, persisted data, schema, setting, IPC format, or Windows implementation changes. Rollback is a revert of this PR; no data recovery or migration is needed.

Verification

• cargo check --workspace --all-targets --locked --offline — passed once on macOS 26.3 arm64 in 1m52s, with no warnings and no block future-incompatibility notice.
• python3 /tmp/orgii-macos-vibrancy-checks/check_availability.py — passed 13 SDK availability checks using SDK 26.1 and an Objective-C probe exercising the selected native selectors/material. Each invocation used xcrun clang -target <target> -isysroot <sdk> -fsyntax-only -fobjc-arc -Wall -Wextra -Werror -Werror=unguarded-availability -Werror=unguarded-availability-new <probe>. Targets: Intel macOS 10.15, 11, 12, 13, 14, 15, 26; arm64 macOS 11, 12, 13, 14, 15, 26. These are API/deployment checks, not OS runtime tests.
• rustfmt --check --edition 2021 --config skip_children=true src-tauri/crates/app-window/src/lib.rs src-tauri/crates/app-window/src/macos_material.rs src-tauri/crates/app-window/src/commands.rs — passed.
• CARGO_NET_OFFLINE=true cargo machete — passed, no unused dependencies.
• cargo update --workspace --offline — removed the unused plugin chain; lockfile comparison confirmed zero additions/upgrades, unchanged retained checksums, and no block package.
• git diff --check and changed-file private-material scan — passed. Reviewed all apply/clear callers, native view ownership, main-thread dispatch, and unchanged frontend/IPC behavior.
• No additional Cargo check, Clippy, Rust test execution, Windows/Linux build, or rendered/visual test was run. Commit hooks that would trigger another compiler pass were bypassed to honor the user's single-check constraint.

Audit

Architecture coverage: layers 1 (compiler/API compatibility), 2 (dependency/view ownership), 3-4 (material naming), 5 (defaults), 6-7 (native boundary), 9 (startup/recovery/detached/toggle parity), and 10 (one material across supported OS versions). Layer 8 network-payload checks were skipped because no wire change exists; IPC signatures were inspected.

Area	Verdict	Evidence	Change or reason kept	Verification
Background work	Keep bounded	AppKit properties own resize/focus appearance	No timers or listeners added	Source inspection; runtime unmeasured
Memory	Improve ownership	One identified native subview; no global registry	Reuse on enable, remove on disable, release with parent	Source inspection; native view-count test not run
Scope/isolation	Preserve	Native view lookup is per window	No cross-window cache or retained pointer across dispatch	Caller and ownership review
Rendering	Changed	Menu material replaces private glass variant	Existing CSS/settings preserved	Compiler/API checks; visual parity unverified