…stale local fallback

- Remove push_metadata_to_sync call from save_notebook. Metadata
  commands now write directly to the sync handle, so pushing stale
  NotebookState metadata would revert dependency changes.

- Remove the now-dead push_metadata_to_sync function entirely (zero
  remaining callers).

- Refresh NotebookState from Automerge before the local save fallback.
  The receiver loop sync-back was removed, so NotebookState cells and
  metadata can be stale. The fallback now pulls current cells and
  metadata from the sync handle before serializing.

- Return Err when add_cell is called without a daemon connection instead
  of silently returning a ghost cell that only exists in React state.

…tion, save-as staleness

- Fix trust_signature loss: approve/verify_notebook_trust now use raw
  JSON read/write (get_raw_metadata_additional, set_raw_trust_in_metadata)
  instead of going through the typed NotebookMetadataSnapshot which
  strips unknown runt fields like trust_signature and trust_timestamp.

- Fix get_runtime_from_sync: add missing ks.language == "python" check
  and language_info fallback to match NotebookState::get_runtime()
  semantics. Custom Python kernels and language_info-only notebooks
  were being misclassified.

- Fix save_notebook_as stale cells: refresh NotebookState from Automerge
  before serializing, same pattern as save_notebook's local fallback.
  Without the receiver loop sync-back, NotebookState can have stale
  cells/metadata from peer updates.

- Document main_is_empty limitation in macOS file association handler:
  dirty flag is no longer set by cell mutations, so untitled notebooks
  with user edits may be reused. Deferred to Phase 1.4.

Add initial_metadata field to Handshake::NotebookSync so the daemon has
the kernelspec before auto-launching a kernel. Previously, new Deno
notebooks would get a Python kernel because the daemon auto-launched
from an empty Automerge doc — the metadata was pushed after connect.

The Tauri app now computes a NotebookMetadataSnapshot at connect time
and includes it in the handshake. The daemon seeds it into the Automerge
doc before the auto-launch decision, so resolve_metadata_snapshot sees
the correct kernelspec.

Backwards compatible: initial_metadata is Option with serde skip_none.