fix(desktop): attribute graceful exit requests

[BradGroux]

Summary

• add a typed AppExitSource to the shared graceful-shutdown entry point
• attribute requests from the macOS app menu, native/Dock termination, tray menu, Tauri runtime, SIGTERM, and SIGHUP
• log the source before shutdown admission so blocked and admitted attempts share the same diagnostic sequence

Closes #2201.

Why

While investigating a report that Cap regularly disappeared after recording or editor work, the signed 0.5.9 app produced no Apple crash report. A controlled Quit during an active Studio recording reached cleanup with both microphone and camera returning FeedLocked, then exited voluntarily with status 0. Cap's own log did not identify the request origin; only the short-lived macOS unified log showed a native Quit AppleEvent/menu action.

The lifecycle guards already merged in #2172 prevent current main from admitting Quit while recording or finalization owns those resources. This patch closes the remaining observability gap so the next report can be classified from Cap's log without guessing whether the process crashed, the OS requested termination, or the user invoked one of several Quit paths.

The source is captured at the common request_app_exit boundary, before state availability, recording/finalization, export, update, or duplicate-exit checks can return. No behavior, timeout, or cleanup ordering changes.

Verification

• cargo fmt --all -- --check
• cargo check -p cap-desktop
• cargo test -p cap-desktop --test exit_shutdown — 21 passed
• desktop frontend production build completed through Tauri's beforeBuildCommand
• local macOS 0.6.0 app bundle built, ad-hoc signed, installed, launched, and remained running

The local machine has Command Line Tools rather than full Xcode, so the small cidre Objective-C shim libraries were compiled with the installed Apple SDK/clang through a temporary local wrapper. That wrapper is not part of this change. Tauri created the .app; the packaging command then reported the expected missing private updater key, so release signing/notarization was not claimed.

Investigation context

• affected stable build: 0.5.9
• comparison head: 82519d2a42a2336545a9f30133330f4d5e10ad0a (0.6.0 source)
• macOS 26.6.2, Apple silicon M4, 24 GB RAM
• Focusrite Scarlett Solo USB negotiated at 192 kHz stereo; Cap resampled to 48 kHz mono
• Logitech BRIO at 1280x720, 30 fps
• no .ips, .crash, .hang, or .spin report for Cap

No recording names, local media paths, account data, or service URLs are included.

Greptile Summary

Adds typed source attribution to the desktop application's shared graceful-shutdown entry point.

• Labels exit requests originating from macOS app and native termination, Tauri runtime events, Unix signals, and the tray menu.
• Logs the source before shutdown admission so both accepted and blocked requests retain diagnostic provenance.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness or security issues identified.

The source parameter is supplied by every existing graceful-exit caller, its platform-gated variants align with their callers, and the change leaves shutdown admission and cleanup behavior intact.

Important Files Changed

Filename	Overview
apps/desktop/src-tauri/src/lib.rs	Introduces the cfg-safe AppExitSource enum, logs it at the common shutdown boundary, and supplies appropriate labels from platform, signal, and runtime callers.
apps/desktop/src-tauri/src/tray.rs	Attributes tray Quit actions to TrayMenu when invoking the shared graceful-exit path.

_{Reviews (1): Last reviewed commit: "fix(desktop): attribute graceful exit re..." | Re-trigger Greptile}

[BradGroux]

Field validation: this instrumentation identified a reported "random crash" after deleting a recording as an external Quit, not a native failure.

Vorssaint 3.3.2 Auto Quit sent Cap an aevt/quit AppleEvent 1.66 seconds after the editor window closed. Cap logged source=MacOsNativeTermination, completed cleanup in 1 ms, and macOS recorded a voluntary status-0 exit; no diagnostic report was generated. Adding so.cap.desktop to Vorssaint's Auto Quit exceptions resolved the local behavior, verified by closing Cap's last visible window and confirming the same process remained alive after four seconds.

This is concrete field evidence for keeping the source attribution in this PR: it prevents clean external termination from being misclassified as a native crash. Full details are recorded in #2201.