fix: confine runtime helper processes to the broker

[devmobasa]

Summary

• Route desktop openers, clipboard tools, OCR, systemctl, and other runtime helpers through the process broker.
• Enforce helper-specific argv, URL, timeout, output, and process-lifetime policies.
• Keep helper work off Wayland callbacks and preserve open/copy operations through focus changes and teardown.
• Add regression coverage for policy bypasses, explicit capture exits, and helper ownership.