feat: add opt-in Linux BlueZ transport probe

[enaboapps]

Scope

Standalone, ordinary-user BlueZ peripheral probe with Switchify service/characteristic UUIDs, offset-aware status reads, bounded framed writes and public-only notifications. No pairing tokens, input, app-runtime integration or Linux release claim. Reuses framing extracted unchanged from the desktop protocol and documents binding choice, peer-isolation uncertainty and the physical validation matrix.

Stack: #711 → #714 → #715 → this PR. Base is the preceding implementation branch as requested. Do not merge out of order or without authorization.

Closes #716 (probe tooling only, not completion of the hardware milestone).

Validation

• Independent review of latest head 773ffc9094ac302f65c286fdbbc89a661eb7ab3d: no remaining actionable findings. Fixed RX ownership reservation and closed-writer replacement ordering, with regression tests for rejected first frames, idle RX-only ownership, active notification ownership and reconnects without stale fragments.
• Local probe formatting, Clippy and all 11 headless tests passed using vendored D-Bus. Default/help invocation is safe and does not access Bluetooth. Local frontend lint, 114 frontend tests, 5 updater-feed tests, production frontend build, native formatting and whitespace checks passed.
• All latest-head CI checks passed: Linux, Windows and macOS native checks/builds, frontend, dependency audit, CodeQL and automated review. CI run. CI builds/tests the probe with system D-Bus headers and never starts advertising.
• Full local Tauri native checks remain unavailable without GTK/WebKit development libraries; native regression validation runs in CI.

Boundaries and next gate

Android/two-adapter interoperability and notification isolation remain unqualified. With the user's supervision approval, the final-head probe was run as ordinary user owen on Linux Mint 22.3 (Ubuntu noble base), kernel 7.0.0-31-generic, BlueZ 5.72-0ubuntu5.5, adapter hci0 (USB ID 8087:0aaa). GATT and advertising registration succeeded without root or radio power changes. The five-minute deadline stopped the process successfully. RX counters remained zero and no TX subscription was observed; phone-side discovery/connection has not been confirmed. This is registration/lifecycle evidence on one host, not completion of the physical test matrix in the checked-in checklist.

After the process exited, BlueZ LEAdvertisingManager1.ActiveInstances was zero, confirming advertisement cleanup. The tool does not contain the authentication engine or credential/input adapters. Only a fixed public diagnostic response can leave TX, so this increment does not depend on unproven subscriber secrecy.

RX-only ownership expires after ten seconds without an accepted frame; active notification ownership persists until teardown. Rejected first frames cannot reserve a peer. Notification failure, unsubscribe, Ctrl-C, SIGTERM and the five-minute serving deadline clear owned session resources. No automatic radio/daemon recovery is implemented.

The hardware checklist was committed before the registration-only experiment above; the remaining physical tests are still unperformed. Secure pairing integration remains gated on that evidence.

[greptile-apps]

Greptile Summary

The PR adds an opt-in Linux BlueZ transport probe for hardware investigation without integrating pairing or input into the desktop runtime.

• Extracts the existing BLE wire framing into a shared Rust module.
• Adds bounded RX reassembly, offset-aware status reads, and fixed public notifications.
• Manages single-peer notification and receive ownership across disconnects and reconnects.
• Adds probe documentation, dependency locking, and Linux CI validation.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported reconnect ownership failure is fixed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
tools/linux-ble-probe/src/probe.rs	Implements bounded BlueZ GATT probe handling and now clears closed notification ownership before admitting reconnects.
tools/linux-ble-probe/src/main.rs	Provides an explicit Linux-only serving command while keeping default and help invocation Bluetooth-free.
src-tauri/src/ble_wire.rs	Holds the extracted shared protocol framing, status serialization, and bounded frame reassembly.
src-tauri/src/protocol.rs	Re-exports the extracted wire implementation while retaining the desktop protocol engine.
.github/workflows/ci.yml	Adds formatting, linting, tests, help-command validation, and dependency auditing for the probe.
docs/linux-bluez-probe.md	Documents the probe’s limited scope, isolation caveats, operation, and uncompleted physical validation matrix.

Sequence Diagram

sequenceDiagram
    participant Peer as BLE peer
    participant BlueZ as BlueZ/BlueR
    participant Probe as Linux probe
    Peer->>BlueZ: Subscribe to TX
    BlueZ->>Probe: Notify writer event
    Probe->>Probe: Clear closed prior session
    Probe->>Probe: Admit peer ownership
    loop Fixed diagnostic cadence
        Probe->>BlueZ: Framed public diagnostic
        BlueZ-->>Peer: Notification
    end
    Peer->>BlueZ: Disconnect or unsubscribe
    BlueZ->>Probe: Writer closed
    Probe->>Probe: Clear ownership and reassembly

Loading

_{Reviews (2): Last reviewed commit: "fix: clear closed notification ownership..." | Re-trigger Greptile}