docs(acl): reconcile spec prose with the shipped implementation

Final-wave cleanups from the whole-branch review (final-review.md Minor
1-5): spec §4 now says selective pruning, not "deletes the directory
every build"; spec §3.3 now describes the TypeScript-AST scan
(fail-closed Vite-order resolution, namespace imports as member access
only, the every-code-file boundary check) instead of the old
regex/chunk description; the viewer spec's historical "every command
is callable from every window" line gets a dated "closed by the
AppManifest lockdown" note; the lib.rs doc comment on
the_generated_app_manifest_matches_the_handler_list no longer claims
independence from the shared parser it actually reuses; and the vitest
command-name regex now allows digits, matching Rust's [a-z0-9_]+.

Also adds a cargo test backstop
(the_tauri_config_capability_check_runs_against_the_real_tree) that
runs build.rs's tauri-config capability check against the real
app/src-tauri tree on every `cargo test`, closing the gap where a new
tauri.<platform>.conf.json on an already-built tree only gets checked
by build.rs on a clean build.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/superpowers/specs/2026-09-22-terminal-file-viewer-design.md

@@ -56,7 +56,9 @@ AppManifest spec, `2026-09-22-app-manifest-lockdown-design.md`).
   `close()`. `lib.rs`'s `on_window_event` returns early for any label but `main`.
 - `build.rs` is a bare `tauri_build::build()`: **every app command is callable from every local
   window**. `capabilities/default.json` gates plugin commands only and lists `windows: ["main"]`.
-  App commands need no capability entry (CLAUDE.md, "Key Conventions").
+  App commands need no capability entry (CLAUDE.md, "Key Conventions"). *(Historical snapshot at
+  `3537b23`. Closed 2026-09-22 by the AppManifest lockdown
+  (`2026-09-22-app-manifest-lockdown-design.md`) — see §6 below.)*
 - The frontend does not know a terminal's cwd. Terminal execs start in `/workspace`; each project
   path is bind-mounted at `/workspace/<mount_name>` (`ProjectPath { host_path, mount_name }`,
   rows with an empty `mount_name` are skipped at container creation). `/workspace` itself is not a