dock: put CipherStick first in Tails favorites

[BenWestgate]

After setup, Tails apps disappear from the dock (reported in #240).

Stacked on #311, which replaces wrapped with cipherstick-login. This PR is one commit that changes the dock code there.

Cause: the login steps replace GNOME's favorite-apps with a hard-coded list. That copy goes stale whenever Tails changes its defaults:

• Files was never in it, so Files disappeared from the dock.
• Tails 7.6 replaced KeePassXC with Secrets, so the password manager vanished too. The list still named org.keepassxc.KeePassXC.desktop.

Change: read the current favorites, then move CipherStick (bails.desktop), Bitcoin Core (bitcoin-qt.desktop) and codex32 (io.github.benwestgate.codex32.desktop) to the front. Every other entry stays as Tails or the user set it.

• codex32 is included because stateless CryoStick users run it every session, and the three icons together introduce CipherStick in the Activities overview.
• No Tails app names are hard-coded, so future Tails releases need no change here, as the draft maintainability policy in docs: define maintainability and PELD policy #277 asks.
• Users' own dock changes now survive.
• If the current list can't be read, the dock is left untouched and the parse error is printed.

Testing (with gsettings mocked)

• Tails' default list: all entries kept, including Secrets and Files, with the three CipherStick icons first.
• CipherStick icons already in the list are moved to the front, not duplicated.
• An empty list (@as []) gives just the CipherStick icons.
• Names containing quotes are handled.
• Unparseable output: no change made.
• shellcheck with CI's flags and bash -n pass.
• Not yet run on Tails.

Refs #240

🤖 Generated with Claude Code

https://claude.ai/code/session_01LvEHMDeHvYQYDEkpJn95X8

[BenWestgate]

github-advanced-security fails here because of a repository setting, not this change. It fails the same way on every open PR, the run reports no findings, and this PR only adds one entry to a list in wrapped. Nothing in this PR can fix it, so I'm ignoring it as instructed.

---

Generated by Claude Code

[BenWestgate]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: cc9973c870

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

LGTM, just consider renaming the .desktop for codex32 soon, it's very long

[BenWestgate]

Thank you @PolymathBT for this bug report!

it's because they replaced KeeppassXC with GNOME Secrets. That's also why strong passphrases were called weak! (I had called KeepassXC to estimate their entropy.)