rename: the desktop is Inkwell — crates, Tauri identity, data move, packaging

Step 3 of milestone 481 (Scribe note 5071: a full rename).

- crates thoughtsync-{core,desktop,ffi,uniffi-bindgen} → inkwell-*, the
  Cargo.lock entries moved to match (checked with `cargo metadata --locked`)
- Tauri: productName "Inkwell", identifier com.fabledsword.inkwell, binary
  `inkwell`, updater feed on bvandeusen/inkwell, store file inkwell.db
- client agent inkwell-desktop, headers X-Inkwell-Client/-Protocol (the server
  reads neither), capture event inkwell://captured, display-version env
- .deb: conflicts + replaces thought-sync, so the updater's install retires the
  old package instead of colliding on it. kebab-case("Inkwell") is `inkwell`, so
  the package name finally matches the command and verify.sh now asserts it
- pacman: inkwell, conflicting with and replacing thoughtsync and
  thoughtsync-desktop
- AppImage ~/Applications/Inkwell.AppImage, menu entry inkwell.desktop,
  installer, release titles, desktop asset names in fetch-clients.sh

The one shim, chosen by the operator because it is the only copy of a
local-first user's notes: crossover.rs moves the old
com.fabledsword.thoughtsync app-data dir's contents into the new one on startup,
before the store opens, renaming thoughtsync.db and its -wal/-shm with it. It
skips when the new dir already has a store, and anything already in the new dir
wins (the installer writes its channel marker there first). Tested.

Android's Kotlin side (package, applicationId, uniffi class) is step 4. Its
release asset names stay thoughtsync.* until then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

desktop/packaging/deb/verify.sh

@@ -13,7 +13,7 @@
 # Five checks, cheapest first:
 #   1. Print the control file + contents — the generated metadata becomes ground
 #      truth in the build log instead of an assumption.
-#   2. Naming: the binary is /usr/bin/thoughtsync and the generated .desktop
+#   2. Naming: the binary is /usr/bin/inkwell and the generated .desktop
 #      entry's StartupWMClass matches it. The app used to identify itself three
 #      different ways depending on install channel (issue 2075); this is what
 #      keeps the .deb — the only channel whose entry Tauri generates for us —
@@ -72,12 +72,17 @@ echo "    (binary: ${BIN#"$WORK/root"})"
 # CANON is the one name the app answers to everywhere: the binary, the CLI
 # command, the icon, and the WM_CLASS the window reports. Hardcoded here on
 # purpose — this literal IS the contract the three install channels are held to.
-# Deliberately NOT asserted: the control file's `Package:` field, which is
-# `thought-sync`. tauri-bundler derives it as kebab-case(productName) with no
-# config override, so "ThoughtSync" splits at the hump. Fixing it would mean
-# unpacking and rewriting the control archive on every build — a fragile step for
-# a cosmetic gain on one uninstall command. Left as a known wart (issue 2075).
-CANON="thoughtsync"
+#
+# The control file's `Package:` field is held to it too. tauri-bundler derives it
+# as kebab-case(productName) with no override, which split "ThoughtSync" into
+# `thought-sync` (issue 2075). "Inkwell" has no hump to split, so the package and
+# the command finally agree, and a productName that brought the split back would
+# also break the `conflicts`/`replaces` retiring the old package.
+CANON="inkwell"
+
+package="$(dpkg-deb -f "$DEB" Package 2>/dev/null || true)"
+[ "$package" = "$CANON" ] ||
+  note_fail "the package is named '${package:-<unset>}', expected '$CANON' (kebab-case of productName)."
 
 installed_bin="${BIN#"$WORK/root"}"
 [ "$installed_bin" = "/usr/bin/$CANON" ] ||
@@ -107,7 +112,7 @@ if command -v dpkg-shlibdeps >/dev/null 2>&1; then
   # dpkg-shlibdeps insists on a debian/control in the working directory even with
   # -O (write to stdout); a stub is enough to let it do the ELF analysis.
   mkdir -p "$WORK/deb-stub/debian"
-  printf 'Source: thoughtsync\n\nPackage: thoughtsync\nArchitecture: amd64\n' \
+  printf 'Source: inkwell\n\nPackage: inkwell\nArchitecture: amd64\n' \
     >"$WORK/deb-stub/debian/control"
   # `|| true`: pipefail is on and dpkg-shlibdeps still exits non-zero on some
   # symbol warnings even with --ignore-missing-info. An empty result degrades to