Linux tray contract: TrayIcon over StatusNotifierItem + dbusmenu

[turinglambdaai]

Closes #118.

What

rivet::system::TrayIcon — the Linux counterpart of the Windows Shell_NotifyIconW adapter (same class name for symmetry): an explicit opt-in that hosts an org.kde.StatusNotifierItem plus a com.canonical.dbusmenu menu over the session bus through GDBus (already a dependency of every Linux host build).

• Opt-in stays an application decision, per the rationale in the old header comment: TrayIcon::available() (a GetNameOwner probe on org.kde.StatusNotifierWatcher) and the new "tray" entry in Capabilities() report a reachable watcher. Without one, the constructor fails clearly — same contract as Notifications on a bus-less session (verified: isolated dbus-run-session → "tray is unavailable: no StatusNotifierItem watcher is running").
• Menu: flat list of TrayMenuItem — labelled items with enabled + click callback, separators; set_menu replaces and bumps the dbusmenu layout revision (LayoutUpdated). Watcher-facing surface implements the methods clients actually call (GetLayout, GetGroupProperties, GetProperty, Event, EventGroup, AboutToShow, AboutToShowGroup, dbusmenu v3), pinned against the Ubuntu AppIndicator extension's client code.
• In-place updates: set_icon / set_tooltip emit NewIcon / NewToolTip; ToolTip serializes KDbusToolTipStruct.
• Watcher restarts: a NameOwnerChanged watch re-registers the item whenever the watcher reappears, so GNOME Shell restarts and AppIndicator extension reloads do not strand a running process without its icon.
• Threading: dispatch (property reads, method calls, click callbacks) lands on the thread-default main context the icon was constructed on — for GTK hosts, the main-loop thread. Documented on the class.
• Left-click Activate reaches an optional activation handler (KDE; the GNOME extension opens the menu instead, matching upstream SNI behavior).
• Integration self-check exercises the tray when the capability is present and skips otherwise (headless-CI safe); docs/system-services.md and the CHANGELOG updated.

Verification (real desktop, not just compile)

• -Wall -Wextra clean compile of system_services.cpp and syntax-check of the integration self-check.
• A live driver on a real Ubuntu 26.04 / GNOME 50 session (ubuntu-appindicators as the watcher):
  • registration shows up in RegisteredStatusNotifierItems (icon visible in the top bar);
  • GetLayout returns the full tree (root + items with correct labels/enabled/separator properties);
  • a delivered Event "clicked" fires the menu callback on the main loop; a click on a disabled item does not;
  • set_icon mid-run flips the icon and subsequent property reads see the new name.
• The watcherless path in an isolated D-Bus session fails clearly instead of crashing.

Deliberately out of scope (follow-ups)

• Submenus (flat menu only — enough for typical tray use; the Racket set-tray-menu! mirror on a Linux adapter, which Linux: tray / StatusNotifierItem contract (tracking the documented honest gap) #118 also proposes, needs an RVT1 carrier first: no Linux host installs a Racket system adapter today).
• IconPixmap (themed icon names only), SecondaryActivate/Scroll behavior (accepted, no-op).

Bug-for-bug note: the two @a{sv}-style format annotations in the GVariant serialization were caught by the live run (bare array positions consumed a pre-built GVariant* as a builder and aborted under the watcher's first layout fetch) — exactly why the verification is a real session, not a mock.