Desktop: keep background startup lightweight and prove Linux packaged-shell E2E #5493

Area

Desktop app performance and Linux release confidence.

Why

The Tauri shell now has the correct startup, ownership, drain, updater, and platform-dialog boundaries, but two release questions remain:

1. A login/autostart launch still navigates the hidden main webview to the full dashboard after the runtime becomes ready. That pays the React dashboard's startup and background-work cost before the user asks to open it.
2. Linux CI compiles and unit-tests the Rust shell, while the installed-artifact workflow is dispatch-only, lives on dev rather than the default branch, has no registered opencodex-gate-linux runner, and requires already-published artifacts. There is no ordinary hosted proof that the packaged AppImage/deb can show a window, launch the bundled sidecar, become healthy, and drain on close in a session with no tray host.

Proposed work

• Keep Tauri and the single bundled ocx sidecar; do not add Electron, another daemon, SSH, VM, or multi-window infrastructure.
• On a hidden autostart launch, retain the lightweight startup surface after Ready and defer loading the full dashboard until the first explicit Open action. Manual launches keep the current immediate dashboard behavior. Startup failures remain visible and retryable.
• Ensure hidden dashboard/popup surfaces do not retain unnecessary polling; refresh once when shown.
• Add bounded Linux packaged-shell E2E on GitHub-hosted Ubuntu under Xvfb/dbus. Exercise AppImage and deb payloads without modifying the runner's real home or package database: isolated HOME/CODEX_HOME/OPENCODEX_HOME, packaged binary/resources, real bundled sidecar, health identity, visible window, no-tray close, and confirmed app/runtime exit.
• Keep the existing self-hosted installed-artifact gate as the later proof for real dpkg/AppImage installation, elevation, takeover, and in-place updates. The hosted E2E must not claim those operations.
• Record cold/attach readiness time, process-tree RSS, and background request counts as evidence first; set regression budgets only from a reviewed baseline rather than invented thresholds.

Acceptance

• Linux hosted E2E is bounded, isolated, cleanup-safe, and runs only trusted repository code with read-only workflow permissions.
• Both package formats exercise the same behavioral assertions and upload a small diagnostic report on failure.
• No access to /home/ubuntu runtime state and no bare bun test, ocx sync, or daemon restart.
• Desktop structure documentation distinguishes hosted packaged-shell E2E from the privileged installed-artifact gate.
• Exact-head CI is green before merge.

@lidge-jun I am taking the Linux packaged-app E2E and the small background-startup efficiency follow-up as separate reviewable PRs. I will keep the release/credential boundary unchanged.