[kev1n77]

Summary

Fixes #3370

User pet spritesheets never resolved: the webview read them with the filesystem plugin, whose scope requires a literal leading dot on unix while every XDG directory starts with one, so the read always failed with forbidden path. The host now serves the bytes through a new load_agent_companion_pet_spritesheet command, confined to the managed companion directory: the request is canonicalized, must stay under that root (symlink escapes are rejected), must be a regular file, and is capped at 16 MiB. The filesystem-plugin scope keeps its dot-literal default instead of being widened to every hidden path under the home directory.

The desktop pet also disappeared behind the app's own page. Wayland compositors drop GTK's keep-above request, so the only stacking relationship the platform still guarantees is "above its parent": on Linux the pet window is now a GTK transient of the main window, and both show paths re-assert always-on-top so X11 keeps floating it above other applications too.

Type and Areas

Type: bug fix

Areas: desktop/Tauri, web UI

Motivation / Impact

Imported user pets could never render on Linux (issue #3370), and the desktop pet could be covered by the application's own window. Users can now actually see the pet they imported, and the pet stays visible while the app window is focused or moved over it. Both changes remain controller-local: load_agent_companion_pet_spritesheet is registered as LocalOnly / ControllerLocal / REFUSED in the Product Operation Registry.

Verification

• pnpm run capabilities:check — passed (693 Tauri commands, registry artifacts regenerated from source).
• cargo check -p openbitfun-product-domains — passed.
• cargo test -p openbitfun-product-domains — 43 passed, including remote_surface::tests::generated_registry_json_matches_compiled_registry and operations_are_sorted_and_unique.
• New Rust unit tests: pet_spritesheet_read_is_confined_to_the_companion_directory and pet_spritesheet_read_rejects_a_symlinked_escape (unix).
• New Web UI tests: spritesheet reads go through the host command, raw byte responses are accepted, and the blob URL cache is reused.
• Manual dev run on Linux/Wayland with an imported user pet package (boba, 2.4 MB spritesheet): load_agent_companion_pet_spritesheet completed in 97 ms with no errors, forbidden path no longer appears in the webview log, and the spritesheet rendered correctly. The companion window was created and shown with no always-on-top or GTK-handle failures logged.

Reviewer Notes

The pet spritesheet read is now controller-local by design; remote workspaces and peer hosts answer REFUSED for this command rather than proxying it. The stacking fix is scoped to #[cfg(target_os = "linux")] and falls back to warn-only logging, so a stacking failure never blocks the pet from showing. The filesystem-plugin scope was intentionally left unchanged, so reverting this commit restores the previous behavior instead of widening API access.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.