Move and resize exact native windows

[iamnbutler]

Add desktop_move and desktop_resize for exact window targets from inventory. Positions use global desktop logical points (including negative coordinates); sizes must be positive. Existing native identity checks, geometry readback, signed outcomes, cancellation, and refreshed inventory remain authoritative, and pi never replays these mutations automatically. Both inherit the locked-session management refusal from #87, because the lock preflight runs before every management op. Related to githubnext/ace2#8 and githubnext/desktop-tools#4.

Now based on main (after #89 landed feat/github-cache), with #85 (drag) and #87 merged in. Resolved conflicts: the DesktopAction op union now covers drag, move, and resize. In docs/desktop-tools.md, the intro lists both drag and move/resize, both the geometry and locked-session paragraphs are kept, and the "later slices" list no longer includes drag-and-drop or window geometry.

Validation on head 8bd13eb5220f84833a8eb04df1157753060739b0: the previously recorded bun types, bun run ci (dprint + oxlint), GitHub CI check, and release Swift build passed. On October 5, the signed development app was rebuilt from this exact head and passed strict app/client signature verification.

Live validation on an unlocked Mac now passes with a fresh signed two-window AppKit fixture and independent receiver frames/callbacks:

• Normal move and resize, with resize using the exact refreshed inventory target and preserving the window's top-left.
• Negative x position: requested and observed x=-40 with confirmed_change.
• Position and size no-ops: confirmed_no_change, no dispatch or receiver callbacks.
• Stale original bounds: refused with no dispatch or receiver change.
• App-constrained resize: requested 400×300, observed the native minimum 640×450; correctly reported unknown / dispatched_unverified, then explicitly read fresh inventory and inspection before restoring geometry.
• Already-aborted resize: refused before native dispatch.
• Real pi/Anthropic claude-opus-5-5: exactly one move and one resize, using the move result's actual refreshed target. Exact tool text/images and usage survived reopening the same pi store without another native call. Both operations matched receiver frames and callbacks.

Beta, both text fields, Save count, focus state and unrelated callbacks stayed unchanged. Signed operation receipts, screenshots, raw results, callback evidence and the pi store were preserved locally; independent artifact review passed. All temporary fixture/native validation processes were stopped after collection.

Still a draft. The requested local live-validation arm is complete. This does not claim multiple-display/negative-y coverage, in-flight geometry cancellation, lock transitions, crash recovery, hosted geometry routing, or another physical machine; broader coverage remains in githubnext/desktop-tools#4/#8.

Built in Ace

The merge, conflict resolution, earlier checks, Swift build, push, and PR update were done by an Ace subagent using Ace's shell tool. The October 5 signed build, fixture build/launch, live native/model runs, cleanup, and tracking updates ran in the Ace terminal of channel pr86-live-testing. Codex prepared temporary scripts and independently read/reviewed the evidence; initial read-only setup discovery used Codex command tools. Native Codex integration (#9) and Ace's file editor (#22) remain open. The original source edits and independent review also used Codex source tools for those gaps.