Adds `desktop_quit` for one exact running application from `desktop_apps`. The native bridge requests normal quit with the observed PID and process generation and never force-quits or retries. Confirmed termination returns `completed`; an accepted request that leaves the application running returns `unknown` and refreshed application/window inventory, so the agent can inspect unsaved-work dialogs deliberately. Later inventory cannot change the recorded quit outcome.

A focused patch to pinned Peekaboo preserves accepted but unfinished normal quit as one dispatched operation with unsafe retry. Its quit-specific result validator permits this uncertain outcome with `false` termination, allowing the existing bridge to retain the signed process receipt instead of rejecting the result. Other contradictory outcomes and force-quit behavior stay unchanged.

Part of #8.

Validated on `086c9c4`, including current main's #120 and #131:

- `bun types`, `bun run ci`, `git diff --check`, signed `bun desktop build dev`, and strict signature verification passed. Independent source and validation-driver reviews found no blocker. - Stale-generation and pre-cancelled requests were refused before the real AppKit fixture received a quit callback. Normal quit with a deferred save sheet produced exactly one callback and `unknown`, `terminated: false`, unsafe retry, and the exact receipt with fresh windows. - A real `gpt-6-sol` channel used `desktop_quit` once to terminate the normal fixture. The completed result retained `terminated: true` when later inventory returned no application. - Closing and reopening the same durable channel kept the exact result and recorded usage, with no new provider response or tool execution. All owned fixtures, app, host, and workers exited; the temporary channel and project were removed.

### Built in Ace

Used Codex for source editing, terminal work, independent review, and validation orchestration under Nate's explicit temporary exception to the Ace-only workflow. Ace did not yet expose the native quit capability being implemented, and this exception allows work on the computer-use gaps in #8 and #5. The real model check ran through Ace's actual source host, channel worker, signed desktop bridge, and durable store. Desktop checks used a coordinated slot and disposable public fixtures.