Replace manual sandbox bypass entry with an app picker

[boycez]

Problem

In Settings > Security > Apps allowed outside the sandbox, users must manually type an app name and press + to add it.

This requires users to know the exact executable or app identifier, provides no validation before saving, and makes it easy to add misspelled or non-existent entries. It is especially difficult for users who know an app by its display name but not its executable name.

Proposed experience

Replace the free-text-first flow with an app picker that lets users choose installed apps.

The picker should:

• Show installed desktop applications with their icon and display name.
• Support search and keyboard navigation.
• Allow selecting one or more apps and adding them in one action.
• Clearly show apps that are already allowed and prevent duplicates.
• Preserve the existing ability to remove an allowed app.
• Provide an explicit fallback for selecting an executable when an app cannot be discovered automatically.

Acceptance criteria

• The Settings page no longer requires users to know or type an executable name for the normal flow.
• Users can open an app picker from Apps allowed outside the sandbox.
• Installed apps are displayed with a recognizable name and icon.
• The picker supports search, keyboard navigation, focus visibility, and screen-reader names.
• Users can add multiple selected apps without creating duplicates.
• Existing allowlist entries remain visible and removable.
• An executable-file fallback is available for portable or undiscoverable apps.
• Selected apps are persisted using identifiers compatible with the existing sandbox bypass behavior.
• Light and dark themes are supported.
• Unit tests cover selection, duplicate prevention, persistence, and removal.

Notes

App selection should use structured installed-app metadata where available rather than deriving identifiers from display strings. The UI should make it clear that apps added here run outside the sandbox and should only be trusted applications.