feat: add settings-safe recovery mode - #23

Summary

When the shell gets stuck in a startup crash loop, users currently face a
black screen (or a constantly restarting desktop) with no way to reach their
settings. This adds a Safe Mode: a recovery session in which the shell
starts normally but optional startup features are suppressed, while all
persisted settings remain untouched and repairable, with added
guidance to nod the users to github issues for bug reporting.

Safe Mode is activated by the session layer (see the matching
singularity-session PR: repeated session/shell crashes write a recovery
marker and relaunch the shell with SINGULARITY_SAFE_MODE=1).

Design

• SafeMode is a process-wide singleton built from the environment:
  SINGULARITY_SAFE_MODE=1, SINGULARITY_SAFE_MODE_MARKER (marker path),
  SINGULARITY_SAFE_MODE_REASON (why recovery is active).
• The normal GSettings backend is deliberately left in place — callers
  consult SafeMode.allows(feature) at runtime instead of rewriting or
  clearing configured values. In safe mode the settings UI still shows the
  configured state and repairs are persisted; they simply take effect on the
  next normal login.
• Suppressed features (SafeFeature): TILING, PLUGINS, CUSTOM_WIDGETS,
  HAND_CONTROL, SESSION_RESTORE, AUTOSTART.

Changes

• src/core/safe_mode.vala (new): SafeFeature enum + SafeMode singleton
  with allows(), clear_marker(), and marker path/reason accessors.
• src/core/main.vala: skip autostart, session-recovery snapshot/restore and
  widget manifest preloading in safe mode; log the recovery reason and open
  the Settings "Desktop" page shortly after startup so the repair surface is
  immediately visible.
• src/core/tiling_manager.vala + dock.vala: tiling and scrolling-tiling
  modes stay off; configuration changes are persisted but no tiling protocol
  requests are sent.
• src/core/plugin_manager.vala: plugins don't load and can't be
  enabled/disabled while recovering.
• src/core/hand_control_manager.vala: hand-control isn't started and an
  already-running instance is stopped; no crash-restart loop.
• src/components/sidebar/pages/desktop_page.vala: new "Safe Mode" group —
  shows the recovery reason and a Restart Normal Session row that clears
  the marker and logs out; the tiling switch explains that the configured
  value is shown but inactive until the next normal login.
• meson.build: safe-mode unit test.

Testing

• tests/safe_mode_test.vala (meson test('safe-mode')): normal mode allows
  every feature, safe mode blocks every feature; clear_marker() removes an
  existing marker and is idempotent when it's already gone.
• Manual: launch the shell with SINGULARITY_SAFE_MODE=1 — desktop comes up
  with tiling/plugins/autostart off, the Safe Mode panel is shown, and
  Restart Normal Session clears the marker and logs out.

Related

• Companion singularity-session change that detects repeated crashes and
  activates this mode.

Tested on NixOS 26.11