macos: pixel attachments, live theming, and a signed app

The AppKit shell now draws what the core renders, follows the theme without a
relaunch, and builds into something you can hand to someone.

- Pixel attachments. Surface.images was dropped on the floor here, so a PDF
  pane showed nothing at all: native_images is now set, pardes_image_s carries
  the geometry the core already clipped, and PardesView keeps one CGImage per
  (serial, page, revision) so scrolling costs a draw and not a decode. Image
  panes get real pixels instead of the petscii fallback.

- Themes take hold live. pardes_tick never advanced the chrome animation, so
  every tagline kept the previous theme's colours until the next launch and
  the 16 ms re-pump spun for the rest of the session. pardes_theme_bg retires
  the hand-agreed #121212 and drives the window background and the titlebar
  appearance; a theme with no background of its own now gets a transparent
  window over an NSVisualEffectView.

- The cell snaps to whole DEVICE pixels rather than whole points. Monaco
  advances 8.4014pt at 14, so ceiling to 9 spaced every column 7.1% wider than
  the face was drawn for.

- The dial is one notch per 10 degrees instead of 20, and a release keeps
  turning in proportion to how hard it was thrown -- ramping up from zero at
  the floor, so a slow twist coasts not a little but not at all.

- A file dropped on the grid is a click plus Look, so it opens beside the pane
  it was dropped on. No drop concept was added to the core.

- The titlebar follows the focused pane: proxy icon, filename, and the dirty
  dot. File.saved_revision is the watermark that last one needed.

- Config (SPC f c) prints the resolved startup config path.

- build.zig assembles, signs and packages the bundle itself; build-app.sh is
  gone. -Dmacos-identity= takes a Developer ID, macos-dmg makes the image, and
  the icon is Glenda.

1 files changed, 23 insertions, 1 deletions

diff --git a/src/builtins.zig b/src/builtins.zig
index f747765d..f207ed9f 100644
--- a/src/builtins.zig
+++ b/src/builtins.zig
@@ -460,7 +460,13 @@ pub const Ascii = struct {
 pub const Save = struct {
     pub fn run(c: Ctx) void {
         // an output buffer has no file behind it — nothing to write
-        if (c.pane.file) |f| if (output_pane.fileTraits(f.output).saves) c.p.emit(.{ .save_file = .{ .pane = @intCast(c.id) } });
+        if (c.pane.file) |*f| {
+            if (!output_pane.fileTraits(f.output).saves) return;
+            c.p.emit(.{ .save_file = .{ .pane = @intCast(c.id) } });
+            // ...and this edit is now the one on disk. See File.saved_revision
+            // for why the mark goes here rather than after the write.
+            f.saved_revision = f.revision;
+        }
     }
 };
 
@@ -536,6 +542,22 @@ pub const Help = struct {
     }
 };
 
+/// Where pardes read its startup commands from — the path, printed into an
+/// output buffer, `SPC f c` or the word executed anywhere.
+///
+/// The one question docs/config.md cannot answer, because the answer depends
+/// on the machine: XDG_CONFIG_HOME if it is set and absolute, else
+/// ~/Library/Application Support/pardes on macOS and ~/.config/pardes
+/// everywhere else. Printing it beats documenting it — the row is ordinary
+/// text, so a right click on it opens the file, and when there is no file
+/// there yet the path is still exactly what you needed to know.
+pub const Config = struct {
+    pub const output: OutputTraits = .{ .name = config.config_buffer };
+    pub fn run(c: Ctx) void {
+        output_pane.openConfig(c.p, c.id) catch |err| c.p.reportError(c.id, "config", err);
+    }
+};
+
 // ---- search ----
 
 // The two builtins that ASK for something — Find walks file NAMES under this