Fix fresh desktop setup and Mac sign-in

[davidmckayv]

Fresh desktop setup could fail during sign-in because it also installed local dependencies. Mac 0.0.12 additionally lacked automatic Bun installation and could fail OpenAI sign-in with rootlessport conflict with ID 1 under Podman.

• Complete installation before offering sign-in, with separate progress and retry. Authentication and launch require prepared assets and cannot download or build missing dependencies.
• Install the pinned, SHA256-verified standalone Bun binary on Mac using built-in unzip, without requiring Xcode Command Line Tools, Homebrew, or Node.
• Publish the OpenAI callback once on Mac Podman. Podman clears host IPs inside its VM, turning the previous IPv4/IPv6 mappings into conflicting duplicates. Docker and Linux Podman retain both bindings.
• Reopen the saved deployment with existing connections, without repeating setup or the onboarding question. Explicit Stop keeps it stopped for the current session.
• Show computer/details in an overlay when the window is too narrow for both panes, preserving the chat draft.
• Disable text substitutions in the admin CEL input so typed quotes remain valid syntax.

Validated visually in the packaged Mac app: installation completed before sign-in; real OpenAI subscription sign-in; actual Hacker News browsing and a rendered chart matching the browser screenshot; narrow/wide details and draft preservation; a typed CEL rule and successful dry run; Cmd+Q, reopening, and explicit Stop. The exact Podman error was reproduced, then the corrected mapping passed both an HTTP callback check and a real Google-to-OpenAI browser authorization using the published auth image, without an API key.

The official Bun binary and all 2,388 deployment dependencies installed successfully with an empty PATH. This checks independence from developer tools on the test host; it does not claim a separate Mac without those tools was used. App testing used the PR frontend/native code with released v0.0.12 backend images. The final native package was rebuilt and reopened at 4820f9e. Windows was not manually retested for this PR.

Checks passed: 835 app tests, 107 desktop UI tests, 462 native library tests (3 existing live-service tests ignored), 135 native binary tests, and subsequent targeted installer/auth regressions. TypeScript, formatting, lint, Clippy across all targets, app production build, and the final packaged Mac build passed.

Validation screenshots and tracking: FOR-311.

Fixes FOR-311

[linear-code]

FOR-311