macos: pixel attachments, live theming, and a signed app

The AppKit shell now draws what the core renders, follows the theme without a
relaunch, and builds into something you can hand to someone.

- Pixel attachments. Surface.images was dropped on the floor here, so a PDF
  pane showed nothing at all: native_images is now set, pardes_image_s carries
  the geometry the core already clipped, and PardesView keeps one CGImage per
  (serial, page, revision) so scrolling costs a draw and not a decode. Image
  panes get real pixels instead of the petscii fallback.

- Themes take hold live. pardes_tick never advanced the chrome animation, so
  every tagline kept the previous theme's colours until the next launch and
  the 16 ms re-pump spun for the rest of the session. pardes_theme_bg retires
  the hand-agreed #121212 and drives the window background and the titlebar
  appearance; a theme with no background of its own now gets a transparent
  window over an NSVisualEffectView.

- The cell snaps to whole DEVICE pixels rather than whole points. Monaco
  advances 8.4014pt at 14, so ceiling to 9 spaced every column 7.1% wider than
  the face was drawn for.

- The dial is one notch per 10 degrees instead of 20, and a release keeps
  turning in proportion to how hard it was thrown -- ramping up from zero at
  the floor, so a slow twist coasts not a little but not at all.

- A file dropped on the grid is a click plus Look, so it opens beside the pane
  it was dropped on. No drop concept was added to the core.

- The titlebar follows the focused pane: proxy icon, filename, and the dirty
  dot. File.saved_revision is the watermark that last one needed.

- Config (SPC f c) prints the resolved startup config path.

- build.zig assembles, signs and packages the bundle itself; build-app.sh is
  gone. -Dmacos-identity= takes a Developer ID, macos-dmg makes the image, and
  the icon is Glenda.

1 files changed, 73 insertions, 1 deletions

diff --git a/src/macos/pardes.h b/src/macos/pardes.h
index 62ddbae5..1591130e 100644
--- a/src/macos/pardes.h
+++ b/src/macos/pardes.h
@@ -174,6 +174,16 @@ bool pardes_should_quit(void);
 // A theme transition is mid-flight and wants ~60 Hz ticks until it settles.
 bool pardes_animating(void);
 
+// What to paint where the grid does not: the window background behind the
+// titlebar and behind a live resize the view has not caught up with. The
+// theme's own background, so it changes the instant the theme does — chrome
+// (taglines, the move box) fades instead, which is why this is not it.
+//
+// PARDES_COLOR_DEFAULT means the theme declares NO background of its own. A
+// terminal wears whatever it was already wearing; a window has nothing to
+// wear, so the host should go transparent and show its own backdrop.
+uint32_t pardes_theme_bg(void);
+
 // ---------------------------------------------------------------- events in
 
 // `cp` is a codepoint or one of PARDES_KEY_*; `text`/`len` are the host's
@@ -200,9 +210,20 @@ void pardes_scroll(float delta_rows, float delta_cols, uint16_t col,
 // is spent as the search-step keys, clockwise `n` and counterclockwise `N`, a
 // notch at a time with the remainder kept — the same accumulate-and-spend
 // shape as pardes_scroll, and in Zig for the same reason. Feed it the raw
-// per-event delta; pass 0 at gesture start to drop a stale remainder.
+// per-event delta; pass 0 at gesture start to drop a stale remainder and to
+// stop a fling still coasting.
 void pardes_rotate(float degrees);
 
+// The fingers lifted. How fast they were moving decides everything: a slow
+// twist stops exactly where it was put, a flick keeps turning in proportion to
+// how hard it was thrown, and the two are the same curve — momentum ramps up
+// from zero rather than switching on at a threshold.
+//
+// A coast makes pardes_animating true and is spent by pardes_tick, so a host
+// that already re-pumps for theme transitions needs no new machinery; one that
+// never calls this simply has a dial with no momentum.
+void pardes_rotate_end(void);
+
 // Run one builtin command line, exactly as executing the same text in a tag
 // would. This is the core's own `command` event, which is how a nested pardes
 // talks to its host; here it is what a menu item is made of, and what opens
@@ -223,6 +244,57 @@ const pardes_cell_s *pardes_frame_cells(void);
 uint16_t pardes_frame_cols(void);
 uint16_t pardes_frame_rows(void);
 
+// One rasterized pixel attachment: a PDF page, or an image pane's pixels.
+//
+// Geometry is in PHYSICAL PIXELS, the space pardes_resize's cell_w/cell_h put
+// the core in. `cell_x`/`cell_y` are the pane body's origin in CELLS and the
+// only thing to multiply out; `dst_*` is relative to that origin and `src_*`
+// is the crop of the raster to take. Both are already clipped to the viewport,
+// so a continuous-scroll page needs no overflow clip of its own — but the body
+// (`cell_w` x `cell_h` cells) is still the rectangle nothing may paint past.
+//
+// `serial`, `page` and `revision` together are the cache key: a host holds its
+// decoded texture while all three hold still, and panning, fit and scrolling
+// deliberately do not move them.
+typedef struct {
+  uint32_t serial;
+  uint32_t page;
+  uint32_t revision;
+  uint16_t cell_x;
+  uint16_t cell_y;
+  uint16_t cell_w;
+  uint16_t cell_h;
+  uint32_t dst_x;
+  uint32_t dst_y;
+  uint32_t dst_w;
+  uint32_t dst_h;
+  uint32_t src_x;
+  uint32_t src_y;
+  uint32_t src_w;
+  uint32_t src_h;
+  // subpixel vertical displacement a proportional wheel kept
+  float offset_y;
+  uint32_t iw;
+  uint32_t ih;
+  // iw * ih * 4 bytes, RGBA8, borrowed until the next pardes_frame
+  const uint8_t *rgba;
+} pardes_image_s;
+
+// This frame's attachments, in paint order. Ask after pardes_frame; both are
+// valid until the next one, exactly like the cell buffer.
+uint32_t pardes_frame_images(void);
+const pardes_image_s *pardes_frame_image_list(void);
+
+// The file behind the FOCUSED pane, or NULL when there is none: a terminal, an
+// output buffer, or nothing focused. PDFs and images count — they are real
+// paths, and a titlebar proxy icon is about the file, not about who may edit
+// it. Borrowed until the next call, like pardes_font_take.
+const char *pardes_active_path(void);
+
+// ...and whether that pane holds edits which are not on disk. Always false for
+// anything with no buffer to save, PDFs and images included.
+bool pardes_active_dirty(void);
+
 // -1 when the cursor is hidden. `bar` asks for a thin insert-mode caret.
 int32_t pardes_cursor_x(void);
 int32_t pardes_cursor_y(void);