fix(windows): make Settings and What's New standard single-Space windows

[quiet-node]

Overview

Settings and the "What's New" window now behave like standard macOS app windows instead of floating overlays. They open in a regular desktop Space, pull you to that Space when summoned from over a fullscreen app, and stay put when you switch to a different fullscreen app. The ask-bar and chat overlay are unchanged: they still float over every Space, including fullscreen ones, which is the core of the product.

Why

Both windows were configured as overlays (can_join_all_spaces + full_screen_auxiliary), so they appeared on every Space and followed the user into any fullscreen app. That is right for the spotlight-style overlay but wrong for window-style surfaces, which should live in a single Space like System Settings and other Mac apps. Managed is the AppKit primitive for an ordinary single-Space app window.

Key changes

• Settings panel uses the Managed collection behavior instead of the overlay flags, so it is bound to one Space.
• The "What's New" window matches: Managed, normal window level (so another app the user clicks rises above it), and it now flips to Regular activation while open (Dock icon + normal layering) so activation pulls the user to its Space. A Managed window shown without activating would land on a Space the user cannot see.
• Added an UPDATE_OPEN flag feeding the activation-policy decision, with the matching update close handler and Dock-click (Reopen) refocus path.
• The overlay (ask-bar/chat) and the onboarding window are deliberately untouched.

Testing

• bun run test:all:coverage: frontend 2210 tests + 100% coverage; backend tests pass; --fail-under-lines 100 holds.
• bun run validate-build: clippy, fmt, typecheck, and a full signed app bundle, all clean.

Note: the Space behavior itself (pull-to-Space, no-follow) is outside the automated gates and is verified by hand on a real machine with fullscreen Spaces. Collection behavior is set only in Rust via set_collection_behavior; there is no visibleOnAllWorkspaces in tauri.conf.json, so this is the single source of truth.