fix(desktop): wrap with wrapGAppsHook3 so tray icon resolves on NixOS

[houko]

Summary

• Tray icon never appeared in librefang-desktop on NixOS, while the AppImage build worked on the same machine (Missing tray icon on NixOS #3192).
• Root cause: tray-icon → libappindicator-sys 0.9.0 dlopens libayatana-appindicator3.so.1 at runtime with no DT_NEEDED entry. The previous fix (Librefang-desktop creates empty window (AppImage and NixOS) #3052) added the lib dir via patchelf --add-rpath, but modern patchelf writes DT_RUNPATH; glibc's ld.so only consults DT_RUNPATH for DT_NEEDED deps — never for dlopen() string-name lookups — so the RPATH was inert and the tray plugin silently failed to load.
• Fix: switch the desktop derivation to wrapGAppsHook3 and inject pkgs.libayatana-appindicator on LD_LIBRARY_PATH via gappsWrapperArgs. As a bonus this also wires the GTK runtime env (XDG_DATA_DIRS, GIO_MODULE_DIR, GSETTINGS_SCHEMA_DIR) that the webview wants.

User confirmed in the issue that adding libayatana-appindicator to environment.systemPackages doesn't help — that's expected, NixOS has no global ld.so.conf, the dlopen simple-name lookup never sees system packages.

References

• crate dlopen path: https://github.com/tauri-apps/libappindicator-rs/blob/main/sys/src/lib.rs
• ld.so(8) on DT_RUNPATH: "Such directories are searched only to find those objects required by DT_NEEDED entries"
• Same-symptom fix in a downstream fork (different codebase, same root cause): Fix NixOS build: nativeBuildInputs, wrapGAppsHook3, libayatana-appindicator runtime closure RightNow-AI/openfang#1063

Test plan

• nix build .#librefang-desktop succeeds on a Linux runner (CI).
• On NixOS with the resulting build, launch librefang-desktop and verify the tray icon appears (right-click menu shows Show Window / Quit / etc).
• Verify the wrapper exports the lib dir: cat $(nix path-info .#librefang-desktop)/bin/.librefang-desktop-wrapped should contain LD_LIBRARY_PATH=…libayatana-appindicator….
• Verify CLI build still green: nix build .#librefang-cli (we did not touch that scope).
• Smoke-test on a non-NixOS Linux distro (Ubuntu) to confirm wrapGAppsHook3 doesn't regress AppImage / cargo build paths.

Closes #3192

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[houko]

@FrantaNautilus thanks for the report. Confirmed root cause + fix on a NixOS 25.11 / GNOME 49.2 box:

• The previous patchelf --add-rpath in flake.nix wrote DT_RUNPATH, which ld.so only consults for DT_NEEDED deps, never for dlopen() string-name lookups. tray-icon → libappindicator-sys does pure runtime dlopen("libayatana-appindicator3.so.1") with no NEEDED entry, so the RPATH was inert. That's also why environment.systemPackages didn't help — NixOS has no /etc/ld.so.conf global cache.
• This PR switches to wrapGAppsHook3 + gappsWrapperArgs to inject LD_LIBRARY_PATH. Verified end-to-end:
  • cat $out/bin/librefang-desktop shows --prefix LD_LIBRARY_PATH : '/nix/store/...-libayatana-appindicator-0.5.92/lib'
  • /proc/<pid>/maps of the running binary shows libayatana-appindicator3.so.1.0.0 and libdbusmenu actually mapped in.
  • GNOME shell receives the SNI item (saw Object Shell.TrayIcon events in journalctl --user).

One caveat I hit while testing — if the GNOME AppIndicator extension you use is v63 on GNOME 49, you'll see the icon flicker because of an upstream extension JS bug (Util.Logger.warning is not a function in trayIconsManager.js:93, GNOME 49 dropped that API). That's separate from this fix; the dlopen path is what the patch resolves. On 47/48 the same build should be fine.

Would appreciate it if you could rebuild from this branch on your NixOS box and confirm the icon shows up. Two extra commits in this PR (fb852858 desktop updater pre-flight, 31b6efd0 CI no-tests=pass) are unrelated noise that surfaced while validating — feel free to ignore those.