Task 2 already closed the risk (build.rs declares a Tauri AppManifest and gates every app command per window); this task brings the docs in line so the threat model of record no longer claims app commands are ungated or that any local window can call any app command. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>