epic(ide): Codewhale Studio — VS Code fork as the canonical desktop (IDE stage 3)

Stage 3 of the ratified IDE program (founder 2026-09-02; PRD §6 "IDE direction"). Epic — break into slices as work starts; this issue is the program anchor.

## Decision

Codewhale Studio is a **VS Code fork** that becomes the **canonical Codewhale desktop application**, replacing the thin Tauri shell (`codewhale-apps/clients/desktop-shell`) once its native services are ported. One canonical desktop implementation (PRD §6); the web app remains the web workbench.

## Ground rules (from the ratified direction)

- **VSCodium patch base**: start from the VSCodium patch set (strips Microsoft branding/telemetry/marketplace, MIT binaries, tracks upstream monthly). New repo `codewhale-studio` with `microsoft/vscode` upstream via VSCodium; monthly rebase cadence.
- **Open VSX only** as the marketplace; Microsoft Marketplace and Microsoft proprietary extensions are never used.
- **Extension-first discipline**: all agent UX is extension code (reuse the extension upgrade issue). Workbench patches exist only where the VS Code extension API provably cannot deliver — the known case is diff/merge-view replacement. Every patch not written is a patch Microsoft can't break on their schedule.
- **One Engine, many clients**: the bundled extension spawns `codewhale app-server --http --port ` with a runtime token (same contract as the desktop shell's `local_runtime.rs`) and drives everything over the Runtime API; ACP remains the outbound interop story for third-party editors.
- **Tideline theming** + canonical whale mark; telemetry off by default (opt-in).

## Task list

- [ ] Create `codewhale-studio` repo from VSCodium base; brand/product.json; CI producing unsigned macOS + Windows builds
- [ ] Bundle + Ed25519-verify the `codewhale` engine binary (port `runtime_bundle.rs` slot pattern into the fork's updater)
- [ ] Bundled extension preinstalled and connected to the bundled engine (depends on the extension upgrade issue)
- [ ] Tideline workbench theme + canonical mark; telemetry default-off verified
- [ ] Native diff/approval surface for agent edits (the one sanctioned fork-patch area)
- [ ] Port Tauri native services: keyring auth, deep links, paired-host relay, companion window (apps-side retirement tracked separately)
- [ ] Code signing + notarization gates; release preflight parity with current desktop checks
- [ ] Prove the monthly upstream rebase twice before general availability
- [ ] Retire the Tauri shell per PRD one-canonical-desktop rule (apps issue; separate acceptance)

## Acceptance (epic-level)

- Signed macOS + Windows Studio builds in CI that run a real agent session end to end: prompt → approvals → diffs, against a bundled engine.
- Two consecutive monthly upstream rebases landed without breaking the agent UX.
- Tauri shell retirement issue closed by ported parity, not deletion of capability.

Start by reading PRD §6 and the existing services in codewhale-apps/clients/desktop-shell, especially local_runtime.rs and runtime_bundle.rs, then compare the VSCodium base and related extension work. Done means the epic acceptance is met: signed macOS and Windows builds run an end-to-end agent session with a bundled engine, two monthly rebases succeed, and Tauri parity is accepted before retirement.

Written by the indexing model from the issue text.