fix(linux): make the companion's Rust test suite runnable and run it (#114260)

Three defects that compounded into a test suite nobody could run and nobody
was running.

The suite has been red on main since 2026-07-20. `connect_frame_matches_gateway_schema`
asserts a TLS-pinned connection advertises no capabilities, but #111933 wrote
that assertion while caps held only inline-widgets, and #111920 made
`agent-kind` unconditional the same day. No textual conflict, so both landed
and the assertion has been wrong ever since. Pinning only withdraws inline
widgets, so assert exactly that.

`cargo test` could not run on macOS at all: tauri-plugin-notifications links a
Swift static library, nothing adds an rpath for the Swift runtime, and every
test binary aborted at load with `Library not loaded:
@rpath/libswift_Concurrency.dylib`. Emit the rpath from build.rs.

Neither surfaced because linux-app.yml never ran `cargo test` - it only checked
formatting and built bundles. Run the suite on Linux, and upgrade the macOS job
from `check` to `test` so link-time breakage like the rpath is caught at all;
`check` never links, so it cannot see this class of failure.

.github/workflows/linux-app.yml

@@ -70,6 +70,10 @@ jobs:
         working-directory: apps/linux/src-tauri
         run: cargo +stable fmt --check
 
+      - name: Run Rust tests
+        working-directory: apps/linux/src-tauri
+        run: cargo +stable test --locked --all-targets
+
       - name: Build Linux companion bundles
         working-directory: apps/linux/src-tauri
         env:
@@ -90,8 +94,8 @@ jobs:
             apps/linux/src-tauri/target/release/bundle/deb/*.deb
             apps/linux/src-tauri/target/release/bundle/appimage/*.AppImage
 
-  check-macos:
-    name: Check macOS companion
+  test-macos:
+    name: Test macOS companion
     # This app also ships macOS desktop-test bundles, but the only job that
     # compiles them (linux-app-release.yml build_macos) runs behind a manual
     # dispatch input. Without a per-PR check, a macOS-gated Tauri API can break
@@ -126,6 +130,10 @@ jobs:
           restore-keys: |
             macos-app-${{ runner.os }}-
 
-      - name: Check macOS companion
+      - name: Test macOS companion
         working-directory: apps/linux/src-tauri
-        run: cargo +stable check --locked --all-targets
+        # `test` rather than `check`: it additionally links and runs the
+        # binaries, which is the only way macOS link-time breakage (a missing
+        # Swift runtime rpath, say) shows up at all. `--all-targets` keeps the
+        # compile coverage `check --all-targets` used to give.
+        run: cargo +stable test --locked --all-targets

apps/linux/src-tauri/build.rs

@@ -1,4 +1,5 @@
 fn main() {
+    link_macos_swift_runtime();
     // Command metadata generates capability permissions independently of the
     // target's invoke handler, so keep the Linux-only command permission known.
     const COMMANDS: &[&str] = &[
@@ -20,3 +21,15 @@ fn main() {
     )
     .expect("Tauri build configuration should be valid");
 }
+
+/// tauri-plugin-notifications links a Swift static library into us, but nothing
+/// adds an rpath for the Swift runtime it pulls in. Bundled apps get one from
+/// the bundler; plain `cargo run` and `cargo test` binaries do not, so they die
+/// at load with `Library not loaded: @rpath/libswift_Concurrency.dylib`. Point
+/// them at the OS runtime so the test suite is runnable on macOS.
+fn link_macos_swift_runtime() {
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("macos") {
+        return;
+    }
+    println!("cargo:rustc-link-arg=-Wl,-rpath,/usr/lib/swift");
+}

apps/linux/src-tauri/src/gateway_ws.rs

@@ -1660,7 +1660,8 @@ mod tests {
             false,
         )
         .expect("pinned connect params");
-        assert_eq!(pinned_params["caps"], json!([]));
+        // Pinning only withdraws inline widgets; agent-kind is unconditional.
+        assert_eq!(pinned_params["caps"], json!([AGENT_KIND_CLIENT_CAPABILITY]));
         std::fs::remove_dir_all(directory).expect("remove connect fixture");
     }