perf(startup): create settings webview on demand [4/6]

[jamditis]

Before submitting

These are required. If you're skipping any, say why in this section.

• I searched existing issues and pull requests (including closed ones) so this isn't a duplicate
• I tested this change locally

Skipping any of the above? Explain why here:

Frontend compilation and production bundling were tested locally. Native launch timing, CPU, and memory measurements require a packaged desktop runner and are left to release validation.

Description

Fourth PR in the v0.6.0 lightweight-launch stack; based on codex/v060-webview-bindings.

Removes the unconditional hidden settings webview. A small atomic lifecycle creates it once when the tray, a normal second launch, macOS reopen, or an update-check action actually needs it. Permission onboarding and no-tray recovery still request it at launch.

A frontend-ready handshake makes a manual update check durable across first creation, concurrent callers share one creation claim, and portable-mode webview data-directory behavior is preserved.

Related issues

Fixes #288

Testing

• Added pure launch-policy tests for hidden startup, permissions, and tray availability.
• Added a concurrent creation-claim test.
• npx tsc --noEmit
• npm run build
• git diff --check
• Native launch/resource measurements: packaged runner required.

Screenshots / videos (optional)

No visual change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T22:23:34.938875Z	fa75c28	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa75c28bd4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jamditis]

Release coordination: keep this pull request open and do not merge it into main until AudioBud v0.6.0 is public. The signed candidate at e417154 is being replaced because both SBOMs contain placeholder file hashes. Merging now would change the release base and restart validation. Continue review and CI cleanup, then send the final green SHA.

[jamditis]

Release coordination note: protected v0.6.0 candidate run 33230355853 passed at a8f57a3. Keep pull requests 311 through 317 unmerged until v0.6.0 publication is complete. The Office clean Windows lane is requested to test artifact audiobud-windows-x86_64-v0.6.0-1: NSIS, MSI, portable signatures and installs, press-start/press-stop dictation, delivery, target lock, the v0.5.0 updater, and uninstall. Report exact evidence before any merge or publication.

[jamditis]

Release coordination update for August 31: AudioBud v0.6.0 remains frozen before tagging. Clean Windows validation of run 33230355853 is still required: NSIS, MSI, portable, press-start/press-stop dictation, delivery, target lock, startup, tray, quit, uninstall, and the v0.5.0 updater path. Keep PRs 311 through 317 unmerged. Reply only on PR 311 with availability, exact evidence, or a blocker so the test record stays in one thread.