fix: recover exports when macOS save panels are unavailable

[richiemcilroy]

macOS can return a nil NSSavePanel, which previously panicked inside rfd on the main thread and froze Studio export. Use a nil-safe asynchronous AppKit save dialog for Tauri and distinguish native dialog failures from cancellation in GPUI. When a Studio save dialog fails, finish rendering to the existing project output and return that path to the completion UI. Explicit Cancel still cancels.

Route screenshot and SRT/VTT caption saves through the safe command too. Grant filesystem access to the selected path on every platform so these callers retain their existing write permissions. Windows/Linux keep their existing native dialog implementation.

Fixes #2163.

Validation:

• Forced nil injection reproduced the locked rfd panic and verified the production Tauri boundary handles it; GPUI now returns a distinct error and Studio chooses its normal output fallback.
• Seven Tauri regression tests passed for native responses, cancellation, selected destinations, and export fallback.
• Current v0.6 working-tree Tauri and GPUI compile checks, desktop TypeScript check, scoped Biome, and Rust formatting passed.
• The isolated PR source passes cargo clippy -p cap-desktop --lib -- -D warnings.

The packaged app still needs a smoke test on the reporter's macOS 26.3 environment, including save, cancel, fallback output, and playback. Native injection ran in a standalone process on macOS 27 arm64. Windows/Linux runtime behavior was reviewed, not exercised here. The isolated GPUI compile check is blocked by the existing checked-in lockfile versus local patched Zed dependencies; the current v0.6 working-tree GPUI check passed with Rust 1.95. This PR changes no GPUI manifest or lockfile.

Confidence Score: 5/5

The PR appears safe to merge, with cancellation, native-dialog failure, selected destinations, and fallback outputs remaining distinct throughout the export flows.

Summary

• Distinguishes explicit cancellation from native save-panel failure in Tauri and GPUI.
• Routes screenshot and caption destinations through the safe save command.
• Grants filesystem access to selected save paths while retaining existing Windows and Linux dialog behavior.
• Adds focused tests for native response classification and export destination fallback.

[richiemcilroy]

hey @greptileai, please re-review the PR