diskern-app's tests are compiled but never run

[Muawiya-contact]

diskern-app's tests are compiled and never run.

The two jobs that touch Rust each miss it from a different side:

# test (ubuntu-22.04 / macos-latest / windows-latest)
- run: cargo test -p diskern-core -p diskern-cli      # diskern-app not in scope

# app-tauri (ubuntu-22.04 / macos-latest / windows-latest)
- run: cargo clippy -p diskern-app --all-targets -- -D warnings   # compiles tests, runs none

--all-targets means a broken test still fails the build, so this has
never shown up as a red X. Nothing has ever executed an assertion in
app/src-tauri/src/.

That was harmless while commands.rs was thin. It isn't now. #94 added
the report-backed quarantine authority — generation leases, fail-closed
stale-finding checks, the cancellation/supersede distinction — and the
tests that pin all of it live in commands.rs. They pass locally and CI
does not know whether they still pass. The layer whose entire job is
refusing to move a file the report calls risky is the one with unchecked
coverage.

Related to #87, which is the same shape one crate over: something
compiles in CI and nothing runs it.

Where to put it

cargo test -p diskern-app needs the Tauri system libraries on Linux —
webkitgtk and friends — which the test job does not install and the
app-tauri job already does. Two options:

• Add cargo test -p diskern-app to the app-tauri job, after the
  clippy step. The deps are already there, and the changes filter
  already skips that job on doc-only PRs. Costs the test runtime only on
  PRs that touch the app or the engine.
• Add -p diskern-app to the test job and install the Linux deps
  there too. Cleaner to read — one job runs all tests — but it duplicates
  the system-dep install and slows the matrix on every PR.

The first looks right, but it does leave "the job that runs tests"
without the app's tests in it, so a note in the job name or a comment
would help the next person.

Worth checking while in there whether app/src-tauri has other test
modules besides commands.rs, and whether the frontend has anything
runnable that npm run build alone is skipping.