chore(tray): replace GTK3 tray backend with ksni

[thewrz]

Summary

• Replaced the GTK3 tray-icon/muda tray backend with ksni StatusNotifierItem over zbus.
• Removed direct gtk, tray-icon, muda, GTK3/appindicator lockfile/vendor entries, and obsolete RustSec ignores.
• Updated CI, Flatpak, and AUR dependency metadata to drop GTK/appindicator/xdo system packages.

Closes #141

Design decisions

• Selected ksni 0.3.5 because it provides a pure-Rust SNI implementation over zbus, including icon pixmap, DBusMenu context menu, activate, and secondary-activate support. License is Unlicense, which is allowed by deny.toml.
• Bumped rust-version from 1.75 to 1.80 because current ksni declares MSRV 1.80. CI already installs stable Rust, so this does not require workflow pin changes.
• Used ksni's blocking wrapper to preserve HonkHonk's existing synchronous tray startup and channel-based TrayEvent contract.
• Used disable_dbus_name(ashpd::is_sandboxed()) for Flatpak compatibility and assume_sni_available(true) so HonkHonk can start even if the SNI watcher appears shortly after the app.
• src/main.rs changed only to remove gtk::init(), which is required to delete the direct gtk dependency. src/app/mod.rs changed only to remove the GTK event-loop pump from Message::TrayPoll, which is required because the new tray backend runs its own D-Bus service.

Dependency justification

ksni replaces tray-icon/muda/gtk because the existing stack permanently pulls GTK3 gtk-rs crates and libappindicator, which are the source of the glib/GTK RustSec advisory noise. Implementing StatusNotifierItem + DBusMenu directly on top of zbus would duplicate a protocol implementation already provided by ksni. The new dependency adds no system -dev packages and removes GTK3, libayatana-appindicator, and xdo requirements.

Verification

• TDD red: cargo test tray::icon::tests initially failed because ksni, HonkTray, and the SNI icon helper were missing.
• TDD green: cargo test tray::icon::tests passed after implementation.
• cargo fmt --check
• cargo test (492 lib tests, 5 main tests, 19 decoder tests; all passed)
• cargo clippy --all-targets -- -D warnings
• cargo deny check
• Guarded cargo-tree absence check reported absent: gtk, glib, gio, atk, cairo-rs, gdk, gdk-pixbuf, pango, libappindicator, libappindicator-sys, tray-icon, muda.
• AUR .SRCINFO freshness checks passed locally for honkhonk, honkhonk-git, and honkhonk-bin.

Manual KDE/GNOME/Hyprland/Sway tray smoke tests were not run in this worktree environment; the implementation remains SNI-only via org.kde.StatusNotifierWatcher.

[coderabbitai]

Warning

Review limit reached

@thewrz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 35 minutes and 58 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ade62726-2c6d-4490-bf86-d7a40aa356b4

📥 Commits

Reviewing files that changed from the base of the PR and between 9d493cb and 2cf90ad.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (23)

• .github/workflows/appimage.yml
• .github/workflows/aur.yml
• .github/workflows/codeql.yml
• .github/workflows/deb.yml
• .github/workflows/rust.yml
• AGENTS.md
• ARCHITECTURE.md
• Cargo.toml
• README.md
• deny.toml
• packaging/aur/README.md
• packaging/aur/honkhonk-bin/.SRCINFO
• packaging/aur/honkhonk-bin/PKGBUILD
• packaging/aur/honkhonk-git/.SRCINFO
• packaging/aur/honkhonk-git/PKGBUILD
• packaging/aur/honkhonk/PKGBUILD
• packaging/aur/honkhonk/README.md
• packaging/flatpak/cargo-sources.json
• packaging/flatpak/io.github.thewrz.HonkHonk.yml
• src/app/mod.rs
• src/main.rs
• src/tray/icon.rs
• src/ui/settings.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/issue-141

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

Claude ultrareview backup for the CodeRabbit usage block has been handled.

Addressed in 2cf90ad:

• Hardened the AUR workflow by moving PR metadata interpolation into environment variables before use in the shell script.
• Restored honkhonk-bin 0.1.0 GTK/appindicator runtime dependencies because that binary release predates the ksni migration; regenerated .SRCINFO.
• Updated user-visible tray credits and docs from tray-icon/muda/libayatana references to ksni where appropriate.

Local verification run after the fix:

• git diff --check
• cargo fmt --check
• cargo test
• cargo clippy --all-targets -- -D warnings
• namcap PKGBUILD
• makepkg --printsrcinfo > /tmp/honkhonk-bin.SRCINFO.fresh && diff -u .SRCINFO /tmp/honkhonk-bin.SRCINFO.fresh