macos: pixel attachments, live theming, and a signed app

The AppKit shell now draws what the core renders, follows the theme without a
relaunch, and builds into something you can hand to someone.

- Pixel attachments. Surface.images was dropped on the floor here, so a PDF
  pane showed nothing at all: native_images is now set, pardes_image_s carries
  the geometry the core already clipped, and PardesView keeps one CGImage per
  (serial, page, revision) so scrolling costs a draw and not a decode. Image
  panes get real pixels instead of the petscii fallback.

- Themes take hold live. pardes_tick never advanced the chrome animation, so
  every tagline kept the previous theme's colours until the next launch and
  the 16 ms re-pump spun for the rest of the session. pardes_theme_bg retires
  the hand-agreed #121212 and drives the window background and the titlebar
  appearance; a theme with no background of its own now gets a transparent
  window over an NSVisualEffectView.

- The cell snaps to whole DEVICE pixels rather than whole points. Monaco
  advances 8.4014pt at 14, so ceiling to 9 spaced every column 7.1% wider than
  the face was drawn for.

- The dial is one notch per 10 degrees instead of 20, and a release keeps
  turning in proportion to how hard it was thrown -- ramping up from zero at
  the floor, so a slow twist coasts not a little but not at all.

- A file dropped on the grid is a click plus Look, so it opens beside the pane
  it was dropped on. No drop concept was added to the core.

- The titlebar follows the focused pane: proxy icon, filename, and the dirty
  dot. File.saved_revision is the watermark that last one needed.

- Config (SPC f c) prints the resolved startup config path.

- build.zig assembles, signs and packages the bundle itself; build-app.sh is
  gone. -Dmacos-identity= takes a Developer ID, macos-dmg makes the image, and
  the icon is Glenda.

7 files changed, 436 insertions, 140 deletions

diff --git a/test/macos-snapshots/boot.golden b/test/macos-snapshots/boot.golden
index 28e5a1de..1c971b3f 100644
--- a/test/macos-snapshots/boot.golden
+++ b/test/macos-snapshots/boot.golden
@@ -23,7 +23,7 @@
 |
 |
 |
-== draw boot 720x408 nonblank
+== draw boot 680x396 nonblank
 == snap resized grid=100x30 cursor=4,2
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |$ /private/tmp/pardes-macos-e2e/boot/cwd                                 New Del
@@ -55,4 +55,4 @@
 |
 |
 |
-== draw resized 900x510 nonblank
+== draw resized 850x495 nonblank
diff --git a/test/macos-snapshots/drop.golden b/test/macos-snapshots/drop.golden
new file mode 100644
index 00000000..b4143983
--- /dev/null
+++ b/test/macos-snapshots/drop.golden
@@ -0,0 +1,94 @@
+== snap booted grid=100x30 cursor=4,3
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|$ /private/tmp/pardes-macos-e2e/drop/cwd                                 New Del
+|  $ printf 'first file\n' > one.txt; printf 'second file\n' > two.txt
+|  $
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+== snap dropped_on_shell grid=100x30 cursor=7,2
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/drop/cwd/one.txt S$ /private/tmp/pardes-macos-e2e/drop/cwd New Del
+|     1 first file                                   $ printf 'first file\n' > one.txt; printf 'secon
+|     2                                              d file\n' > two.txt
+|                                                    $
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+== snap dropped_on_document grid=100x30 cursor=7,17
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/drop/cwd/one.txt S$ /private/tmp/pardes-macos-e2e/drop/cwd New Del
+|     1 first file                                   $ printf 'first file\n' > one.txt; printf 'secon
+|     2                                              d file\n' > two.txt
+|                                                    $
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|  /private/tmp/pardes-macos-e2e/drop/cwd/two.txt S
+|     1 second file
+|     2
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+|
+== draw drop 850x495 nonblank
diff --git a/test/macos-snapshots/drop.snap b/test/macos-snapshots/drop.snap
new file mode 100644
index 00000000..f427fe2a
--- /dev/null
+++ b/test/macos-snapshots/drop.snap
@@ -0,0 +1,37 @@
+# A file dropped ON the grid opens beside the pane it was dropped on.
+#
+# Finder and the Dock already reach the app through application(_:open:), but
+# that path cannot say WHERE — it opens next to whichever pane happened to have
+# focus. A drop knows where the hand was, and in acme that is the whole
+# difference: `Look` places the document relative to the pane it runs in.
+#
+# So a drop is defined as a CLICK followed by `Look`, and nothing more. The
+# click focuses the pane under the pointer exactly as a left click there would,
+# then the ordinary builtin runs in it. There is no drop concept in the core
+# and none was added — everything here the hand could have done itself.
+#
+# `drop` drives PardesView.drop, one call below performDragOperation, because
+# NSDraggingInfo is a protocol with no public conformer: a test that had to
+# build one would be testing its own stub. See the trackpad scripts for the
+# same reasoning about NSTouch and pressure stages.
+start 30 100
+wait 8000 $
+stable 700 20000
+text printf 'first file\n' > one.txt; printf 'second file\n' > two.txt
+key enter
+wait 8000 $
+stable 700 20000
+snap booted
+# Dropped on the shell: one.txt opens as a document beside it. Absolute,
+# because the core resolves a relative Look against the PANE's directory —
+# the same absolute path the AppKit side builds out of an NSURL.
+drop /private/tmp/pardes-macos-e2e/drop/cwd/one.txt 10 6
+stable 700 15000
+snap dropped_on_shell
+# ...and now the placement is the assertion. Dropping the SECOND file inside
+# the pane the first one opened puts it next to that pane, not next to the
+# shell — which is only true because the click went where the pointer was.
+drop /private/tmp/pardes-macos-e2e/drop/cwd/two.txt 10 20
+stable 700 15000
+snap dropped_on_document
+draw drop
diff --git a/test/macos-snapshots/font.golden b/test/macos-snapshots/font.golden
index e61abecd..759e7738 100644
--- a/test/macos-snapshots/font.golden
+++ b/test/macos-snapshots/font.golden
@@ -73,9 +73,9 @@
 |
 |
 |
-== snap bigger grid=81x19 cursor=4,2
+== snap bigger grid=77x18 cursor=4,2
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
-|$ /private/tmp/pardes-macos-e2e/font/cwd              New Del
+|$ /private/tmp/pardes-macos-e2e/font/cwd          New Del
 |  $
 |
 |
@@ -92,7 +92,6 @@
 |
 |
 |
-|
 == snap reset grid=100x24 cursor=4,2
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |$ /private/tmp/pardes-macos-e2e/font/cwd                                 New Del
@@ -118,9 +117,9 @@
 |
 |
 |
-== snap floor grid=225x58 cursor=4,2
+== snap floor grid=242x56 cursor=4,2
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
-|$ /private/tmp/pardes-macos-e2e/font/cwd                                                                                                                                                              New Del
+|$ /private/tmp/pardes-macos-e2e/font/cwd                                                                                                                                                                               New Del
 |  $
 |
 |
@@ -175,5 +174,3 @@
 |
 |
 |
-|
-|
diff --git a/test/macos-snapshots/rotate.golden b/test/macos-snapshots/rotate.golden
index 54f0d217..f0cc1eac 100644
--- a/test/macos-snapshots/rotate.golden
+++ b/test/macos-snapshots/rotate.golden
@@ -1,156 +1,280 @@
-== snap results grid=100x30 cursor=4,8
+== snap results grid=100x30 cursor=4,25
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
-|
-|  x MARK a
 |  zz
-|  x MARK b
+|  x MARK 14
+|  zz
+|  x MARK 15
+|  zz
+|  x MARK 16
+|  zz
+|  x MARK 17
+|  zz
+|  x MARK 18
+|  zz
+|  x MARK 19
+|  zz
+|  x MARK 20
+|  zz
+|  x MARK 21
+|  zz
+|  x MARK 22
+|  zz
+|  x MARK 23
+|  zz
+|  x MARK 24
 |  zz
-|  x MARK c
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
 |
 |  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
-|     1 @p0:2:3-6 x MARK a
-|     2 @p0:4:3-6 x MARK b
-|     3 @p0:6:3-6 x MARK c
-== snap forward grid=100x30 cursor=7,3
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap forward grid=100x30 cursor=7,4
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
-|  x MARK a
+|
+|  x MARK 01
 |  zz
-|  x MARK b
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
 |  zz
-|  x MARK c
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
 |  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
-|     1 @p0:2:3-6 x MARK a
-|     2 @p0:4:3-6 x MARK b
-|     3 @p0:6:3-6 x MARK c
-== snap forward2 grid=100x30 cursor=7,5
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap forward2 grid=100x30 cursor=7,6
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
-|  x MARK a
+|
+|  x MARK 01
 |  zz
-|  x MARK b
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
 |  zz
-|  x MARK c
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
 |  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
-|     1 @p0:2:3-6 x MARK a
-|     2 @p0:4:3-6 x MARK b
-|     3 @p0:6:3-6 x MARK c
-== snap back grid=100x30 cursor=7,5
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap back grid=100x30 cursor=7,6
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
-|  x MARK a
+|
+|  x MARK 01
 |  zz
-|  x MARK b
+|  x MARK 02
 |  zz
-|  x MARK c
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
+|  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap forward_by_key grid=100x30 cursor=7,8
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
 |
+|  x MARK 01
+|  zz
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
+|  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap placed grid=100x30 cursor=7,8
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
 |
+|  x MARK 01
+|  zz
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
+|  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap placed_released grid=100x30 cursor=7,8
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
 |
+|  x MARK 01
+|  zz
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
+|  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
+|     1 @p0:3:3-6 x MARK 01
+|     2 @p0:5:3-6 x MARK 02
+|     3 @p0:7:3-6 x MARK 03
+== snap thrown grid=100x30 cursor=7,16
+|New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
+|  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
 |
 |
+|  x MARK 01
+|  zz
+|  x MARK 02
+|  zz
+|  x MARK 03
+|  zz
+|  x MARK 04
+|  zz
+|  x MARK 05
+|  zz
+|  x MARK 06
+|  zz
+|  x MARK 07
+|  zz
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
 |  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
-|     1 @p0:2:3-6 x MARK a
-|     2 @p0:4:3-6 x MARK b
-|     3 @p0:6:3-6 x MARK c
-== snap forward_by_key grid=100x30 cursor=7,7
+|     5 @p0:11:3-6 x MARK 05
+|     6 @p0:13:3-6 x MARK 06
+|     7 @p0:15:3-6 x MARK 07
+== snap thrown_coasted grid=100x30 cursor=7,22
 |New Newcol Find Grep Help Tutor Dump NextColor Debug Kill
 |  /private/tmp/pardes-macos-e2e/rotate/cwd                               New Del
-|
-|  x MARK a
+|  x MARK 07
 |  zz
-|  x MARK b
+|  x MARK 08
+|  zz
+|  x MARK 09
+|  zz
+|  x MARK 10
+|  zz
+|  x MARK 11
+|  zz
+|  x MARK 12
+|  zz
+|  x MARK 13
+|  zz
+|  x MARK 14
+|  zz
+|  x MARK 15
+|  zz
+|  x MARK 16
+|  zz
+|  x MARK 17
+|  zz
+|  x MARK 18
 |  zz
-|  x MARK c
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
-|
 |  /private/tmp/pardes-macos-e2e/rotate/cwd/+Search                       New Del
-|     1 @p0:2:3-6 x MARK a
-|     2 @p0:4:3-6 x MARK b
-|     3 @p0:6:3-6 x MARK c
-== draw rotate 900x510 nonblank
+|    15 @p0:31:3-6 x MARK 15
+|    16 @p0:33:3-6 x MARK 16
+|    17 @p0:35:3-6 x MARK 17
+== draw rotate 850x495 nonblank
diff --git a/test/macos-snapshots/rotate.snap b/test/macos-snapshots/rotate.snap
index 17b239f4..1f2e4667 100644
--- a/test/macos-snapshots/rotate.snap
+++ b/test/macos-snapshots/rotate.snap
@@ -5,21 +5,26 @@
 # kind of thing a unit test on the accumulator cannot catch and a golden can:
 # what the screen does is the assertion.
 #
-# One notch is 20 degrees (rotation_notch_degrees in src/macos.zig) and the
-# remainder is banked, which makes the pair below exact rather than approximate:
-# -25 spends one notch and banks -5, then +25 lands on 20 and spends one back.
+# One notch is 10 degrees (rotation_notch_degrees in src/macos.zig) and the
+# remainder is banked, which makes the pairs below exact rather than
+# approximate: -12 spends one notch and banks -2.
 start 30 100
 wait 8000 New Newcol
 wait 8000 $
 stable 700 20000
-text printf 'x MA''RK a\nzz\nx MA''RK b\nzz\nx MA''RK c\n'
+# Twenty-four hits, not three. A coast is worth asserting only on a list long
+# enough to coast ALONG: `n` at the last match has nowhere to go, so on a
+# three-hit list the hardest possible flick and no flick at all produce the
+# same screen — which is a golden that would have passed before momentum
+# existed. printf reuses its format once per argument.
+text printf 'x MA''RK %s\nzz\n' 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
 key enter
-wait 10000 MARK c
+wait 10000 MARK 24
 stable 700 10000
 key c-b
 stable 600 8000
 # `/` types the pattern into the tag; Enter searches the pane's scrollback and
-# writes the three hits into a +Search buffer, which is what n/N walk.
+# writes the hits into a +Search buffer, which is what n/N walk.
 text /
 stable 400 5000
 text MARK
@@ -32,25 +37,25 @@ snap results
 # twist cannot make the first degree of this one jump a match.
 rotate 0
 # Clockwise: one notch of `n`, forward onto the first hit and selecting it.
-rotate -25
+rotate -12
 stable 700 15000
 snap forward
 # ...and again, onto the second. Two steps out rather than one, because the
 # first hit is where the list already starts: stepping BACK from it has nowhere
 # to go, and a golden that cannot move is a golden that proves nothing about
 # which way the dial turns.
-rotate -25
+rotate -12
 stable 700 15000
 snap forward2
 # A new gesture, because the dial banks its remainder exactly like the scroll
-# accumulator does: two 25-degree notches leave -10 behind, so reversing INSIDE
-# the same twist would have to spend that first and 25 back would move nothing.
+# accumulator does: two 12-degree notches leave -4 behind, so reversing INSIDE
+# the same twist would have to spend that first and 12 back would move nothing.
 # That hysteresis is wanted — it is what stops a thumb resettling on a notch
 # boundary from flip-flopping between two matches — and lifting the fingers is
 # how a hand clears it.
 rotate 0
 # Counterclockwise: `N`. This must land back exactly on `forward`.
-rotate 25
+rotate 12
 stable 700 15000
 snap back
 # And the other half of the contract: a twist IS the keystroke, so typing the
@@ -60,4 +65,43 @@ snap back
 text n
 stable 700 15000
 snap forward_by_key
+# ---- momentum ----
+#
+# The dial coasts in proportion to how fast it was RELEASED, ramping up from
+# zero at the floor rather than switching on at it. Both halves of that are
+# here, and the gap argument is what makes them different: it is a real sleep
+# before the event, so libpardes measures a real speed off its clock.
+#
+# PLACED. Four degrees every 100 ms is 40 deg/s, under the 70 deg/s floor, so
+# lifting the fingers changes nothing at all — the twist itself has moved one
+# notch and that is where it stops. This is the case that has to hold: a slow
+# deliberate turn that kept sliding afterwards would be unusable.
+rotate 0
+rotate -4 100
+rotate -4 100
+rotate -4 100
+stable 700 15000
+snap placed
+rotate_end
+stable 700 15000
+# Byte-identical to `placed`, which is the whole assertion.
+snap placed_released
+# THROWN. The same twist delivered in 5 ms slices is hundreds of degrees a
+# second, so the release keeps the list walking after the fingers are gone.
+#
+# `snap` and then `rotate_end` with NO `stable` between them, which is not
+# impatience: a release is only a throw if it arrives while the hand is still
+# moving, and a 700 ms wait here would be a hand that stopped — which is
+# exactly what the PLACED case above already proves. The snapshot is a frame
+# read, far inside the 90 ms that separates the two.
+rotate 0
+rotate -12 5
+rotate -12 5
+rotate -12 5
+snap thrown
+rotate_end
+stable 700 15000
+# ...and this one must NOT match `thrown`: the fling moved on its own, after
+# the gesture was over. That difference IS the feature.
+snap thrown_coasted
 draw rotate
diff --git a/test/macos-snapshots/trackpad.golden b/test/macos-snapshots/trackpad.golden
index 82edf68b..5a82ea85 100644
--- a/test/macos-snapshots/trackpad.golden
+++ b/test/macos-snapshots/trackpad.golden
@@ -308,4 +308,4 @@
 |     1 @p0:2:3-6 x MARK a
 |     2 @p0:4:3-6 x MARK b
 |     3 @p0:6:3-6 x MARK c
-== draw trackpad 900x510 nonblank
+== draw trackpad 850x495 nonblank