[w3irdrobot]

Summary

• Fix Linux System appearance when debugger protection prevents xdg-desktop-portal from identifying the GUI through /proc/<pid>/root.
• Run a portal-only child of the existing executable through hidden --internal-theme-watch mode. Keep the GUI's original hardening order; disable core dumps in the helper without making the GUI debugger-accessible.
• Clear the child's environment except desktop-bus settings, close inherited descriptors beyond stdio, and accept only bounded theme frames over private pipes. Bound startup, terminate the child on shutdown/parent-pipe closure, and preserve explicit Dark/Light overrides.
• Add parser, environment/descriptor isolation, timeout, lifecycle, palette precedence, and exact-executable regressions.

Validation

• Live KDE portal: nix develop --no-update-lock-file -c cargo test --locked -p maple-agent-app --test system_theme_helper -- --include-ignored — 3 passed. Verifies initial theme output, portal-compatible process visibility, disabled core dumps, parent-pipe shutdown, CLI isolation, and no application-state writes.
• Formatting, 9 Git metadata tests, and all four Clippy feature configurations passed in the component's pinned Nix environment.
• Full Agent CI was stopped during the warning-denied workspace build at the author's request; full workspace builds/tests are not claimed as passing.
• Visual theme-switch smoke and packaged Prod runtime: not verified in this session. No signing, publication, installed-app replacement, or live-service changes.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[AnthonyRonning]

Reviewed the Linux theme helper isolation and lifecycle, theme override precedence, and macOS compatibility. No actionable findings; applicable hosted CI passed for this revision.