fix(desktop): use a supported macOS bundle icon size

[sunrioa]

Summary

Use Electron's macOS-supported normal file-icon size for the packaged permission overlay. Both native bundle-icon reads now share the same option, while unpackaged development continues to skip native icon loading.

Add a regression test covering the unpackaged bypass and the packaged normal option.

Fixes #3352
Refs #1919
Refs #1920

Verification

Passed locally:

• corepack npm --workspace @maka/desktop test — 979 passed
• corepack npm --workspace @maka/desktop run e2e — 34 passed, 1 skipped
• corepack npm run lint — passed
• corepack npm run format:check — passed
• corepack npm run build — passed
• corepack npm run typecheck — passed
• corepack npm exec -- knip --workspace apps/desktop — passed
• corepack npm exec -- knip --workspace packages/ui — passed
• corepack npm run astryx:theme -- --check — passed
• node scripts/audit-alignment.mjs — passed
• node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs — 21 passed
• corepack npm run windows:inventory — passed
• git diff --check — passed

corepack npm test was also attempted, but was not green on this machine for failures outside this Desktop change:

• Eval's Harbor Python test requires Python 3.10+; this host has Python 3.9.6.
• One Storage child-process test treats Node's SQLite experimental warning on stderr as a failure; that test file passes 5/5 with NODE_NO_WARNINGS=1.
• Runtime and MCP passed when rerun separately (Runtime: 2968 passed, 13 skipped; MCP: 115 passed).

Not run:

• Manual smoke test of the fix in a signed/notarized macOS package; release signing/notarization credentials are unavailable.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope:

OpenAI Codex assisted with crash-log analysis, implementation, the regression test, local verification, and drafting this description. I reviewed the final diff and test results.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No