Desktop: integrate safe settings and provider references

[qwen-code-dev-bot]

Parent

Parent: #105

What to build

Provide a desktop Settings surface that integrates with the product layered settings contract: workspace-scoped configuration, sanitized model display names, permission mode, and operating-system-backed provider credential references. It must not create a second settings authority.

Acceptance criteria

• Users can inspect and update permitted layered settings with clear scope.
• The UI renders configured/missing credential status and a display alias, never a raw provider secret.
• A workspace setting change is reflected only at a safe request boundary.
• Tests cover validation, migration/default behavior, and secret redaction.
• A PR-bound tmux E2E receipt and screenshot prove settings behavior using sanitized data.

Blocked by

• Complete the settings hierarchy with trusted project scope and schema migration #91
• Inspect and manage effective settings from commands and the TUI #92
• Desktop: launch a secure macOS session shell #106

Integration should follow #108 so the workbench can surface resulting status.

[qwen-code-dev-bot]

Fail-closed containment: #110 must reuse the #91/#92 settings authority. PR #141 merged #91 after an unauthorized provenance reclassification, without new source evidence or maintainer authorization on #91. Keep #110 blocked until that transition is audited and #92 is explicitly released. This does not alter the separate Desktop macOS evidence blocker tracked by #133.