feat(app): wire desktop window icon — Terminal ▌RS mark at runtime

Closes Resume-prompt Option A (the post-v0.21.0 first option).
Half-day desktop work, no cert dependency.

Three deliverables:

1. **SVG-authored icon** (`solitaire_engine/src/assets/icon_svg.rs`)
   — square Terminal mark: `#151515` background, brick-red
   `#a54242` 1 px border, brick-red ▌ cursor block centered, "RS"
   monogram in `#d0d0d0` foreground gray beneath. Same shape that
   already lives on the splash boot screen and card-back monogram,
   reused as the project's signature visual mark. Authored in a
   64-unit logical box so it scales cleanly at every rasterisation
   target.

2. **9-size PNG hierarchy** (16, 24, 32, 48, 64, 128, 256, 512, 1024
   px) regenerated by `solitaire_engine/examples/icon_generator.rs`
   into `assets/icon/icon_<size>.png`. Sizes cover Linux hicolor
   (16, 24, 32, 48, 64, 128, 256, 512), Windows .ico targets (16,
   32, 48, 256), and macOS .icns targets (16, 32, 64, 128, 256,
   512, 1024). The runtime path uses just the 256 px slot; the
   smaller sizes are pre-rendered for downstream packaging.

3. **Runtime `Window::icon` wiring** (`solitaire_app/src/lib.rs`).
   Bevy 0.18 has no `Window::icon` field — the icon is set through
   the underlying `winit::window::Window` via the `WinitWindows`
   resource. `set_window_icon` runs each Update tick, retries
   silently until `WinitWindows` is populated (typically frame 1
   or 2), decodes the embedded 256 px PNG via `tiny_skia`, builds
   a `winit::window::Icon`, and self-disables via `Local<bool>`.
   Same one-shot pattern as `apply_smart_default_window_size`.
   Desktop-only — Android draws its launcher icon from the APK
   manifest, so the system is target-gated to
   `cfg(not(target_os = "android"))`.

Dep changes (CLAUDE.md §8 user-confirmed):

- `winit = "0.30"` promoted from a transitive Bevy dep to a direct
  dep on `solitaire_app` so `winit::window::Icon` is in scope —
  bevy_winit 0.18 doesn't re-export it. Version pinned to whatever
  Bevy uses; if Bevy bumps winit, this line bumps in lockstep.
- `tiny-skia` added as a direct dep on `solitaire_app` for PNG →
  RGBA decode. Already in workspace deps for `solitaire_engine`;
  no version drift risk.
- Both new deps target-gated to non-Android only.

Test infrastructure: `solitaire_engine/tests/icon_svg_pin.rs`
hashes the rasterised RGBA bytes at all 9 sizes via FNV-1a (same
shape as `card_face_svg_pin`). Bootstrap pattern (empty EXPECTED
→ panic with hashes formatted as Rust source → paste back in)
handles future intentional builder edits cleanly.

Workspace clippy + cargo test --workspace clean. 1185 passing
(+1 from v0.21.0's 1184 baseline — the icon pin's
`rasterised_icon_bytes_match_pinned_hashes`).

Out of scope for this commit: `.icns` / `.ico` bundling for
macOS / Windows app packaging. Both are packaging-time concerns
(set via bundle manifests, not runtime calls) and would need new
deps (`ico` and `icns` crates) — separate followup if/when the
project ships as a packaged macOS / Windows app rather than just
`cargo run`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

solitaire_app/Cargo.toml

@@ -22,16 +22,25 @@ bevy             = { workspace = true }
 solitaire_engine = { workspace = true }
 solitaire_data   = { workspace = true }
 
-# `keyring`'s default-store init only matters on platforms with a
-# real keychain backend (Linux Secret Service, macOS Keychain,
-# Windows Credential Store). The crate also pulls `rpassword`
-# transitively, which uses `libc::__errno_location` — a symbol
-# Android's bionic doesn't expose. Target-gating keeps
-# `cargo apk build` viable; the call site in `lib.rs` has its own
-# `cfg(not(target_os = "android"))` guard so the desktop init path
-# is unchanged.
+# Desktop-only deps. `keyring`'s default-store init only matters on
+# platforms with a real keychain backend (Linux Secret Service,
+# macOS Keychain, Windows Credential Store), and its transitive
+# `rpassword` uses `libc::__errno_location` — a symbol Android's
+# bionic doesn't expose. `winit` is promoted from a transitive
+# Bevy 0.18 → bevy_winit 0.18 → winit 0.30 dep to a direct dep so
+# the `Window::icon` wiring in `set_window_icon` can construct
+# `winit::window::Icon` values (bevy_winit 0.18 doesn't re-export
+# `Icon`). Android draws its launcher icon from the APK manifest,
+# so neither dep matters there. Target-gating keeps `cargo apk
+# build` viable; the desktop call sites have their own
+# `cfg(not(target_os = "android"))` guards.
 [target.'cfg(not(target_os = "android"))'.dependencies]
-keyring          = { workspace = true }
+keyring   = { workspace = true }
+winit     = { version = "0.30", default-features = false }
+# `tiny-skia` is already in the workspace deps for `solitaire_engine`;
+# `solitaire_app` consumes it directly only on the desktop icon path
+# (PNG → raw RGBA decode for `set_window_icon`).
+tiny-skia = { workspace = true }
 
 # --- Android packaging metadata (read by `cargo-apk`) -------------------
 #

solitaire_app/src/lib.rs

@@ -21,6 +21,8 @@ use bevy::prelude::*;
 use bevy::window::{
     Monitor, MonitorSelection, PresentMode, PrimaryMonitor, PrimaryWindow, WindowPosition,
 };
+#[cfg(not(target_os = "android"))]
+use bevy::winit::WinitWindows;
 use solitaire_data::{load_settings_from, provider_for_backend, settings_file_path, Settings};
 use solitaire_engine::{
     register_theme_asset_sources, AchievementPlugin, AnimationPlugin, AssetSourcesPlugin,
@@ -174,6 +176,14 @@ pub fn run() {
         .add_plugins(SplashPlugin)
         .add_plugins(DiagnosticsHudPlugin);
 
+    // Wire the runtime window icon. Bevy 0.18 has no first-class
+    // `Window::icon` field; the icon is set through the underlying
+    // `winit::window::Window` via `WinitWindows`. Android draws its
+    // launcher icon from the APK manifest, so the system is desktop-
+    // only — same target-gate as the `winit` dep itself.
+    #[cfg(not(target_os = "android"))]
+    app.add_systems(Update, set_window_icon);
+
     // Smart default window sizing: when no saved geometry was loaded,
     // resize the freshly-opened 1280×800 window to ~70 % of the primary
     // monitor's logical size on the first frame. Without this, a 4K
@@ -251,6 +261,71 @@ fn apply_smart_default_window_size(
     *applied = true;
 }
 
+/// One-shot Update system that sets the primary window's taskbar /
+/// title-bar icon to the embedded 256 px Terminal-aesthetic mark
+/// generated by `solitaire_engine/examples/icon_generator.rs`.
+///
+/// Bevy 0.18 has no `Window::icon` field — the icon is set through
+/// the underlying `winit::window::Window` via the `WinitWindows`
+/// resource. The system is desktop-only (Android draws its launcher
+/// icon from the APK manifest, not from any runtime call). Returns
+/// silently and tries again next frame until both the primary
+/// window and `WinitWindows` are populated, then sets the icon
+/// once and self-disables via `Local<bool>`.
+///
+/// Icon bytes are `include_bytes!()`-embedded at compile time, same
+/// shape as the audio assets and default-theme SVGs — no runtime
+/// asset-path resolution, no `cargo run` working-directory
+/// assumptions. PNG → RGBA decode runs through `tiny_skia` (already
+/// in the build for SVG rasterisation), so this system adds zero
+/// new dependencies on top of the direct `winit` dep that's
+/// already required for `Icon` construction.
+#[cfg(not(target_os = "android"))]
+fn set_window_icon(
+    mut applied: Local<bool>,
+    primary_window: Query<Entity, With<PrimaryWindow>>,
+    winit_windows: NonSend<WinitWindows>,
+) {
+    if *applied {
+        return;
+    }
+    let Ok(primary_entity) = primary_window.single() else {
+        return;
+    };
+    let Some(window_wrapper) = winit_windows.get_window(primary_entity) else {
+        // Primary window's underlying winit handle not yet
+        // populated — `WinitWindows` fills in after the first
+        // `Resumed` event. Try again next frame.
+        return;
+    };
+
+    // The 256 × 256 PNG is sufficient for `set_window_icon`; winit
+    // scales it for the actual rendered size. Smaller PNGs in
+    // `assets/icon/` exist for downstream Linux hicolor / Windows
+    // `.ico` / macOS `.icns` packaging — they're not used here.
+    const ICON_BYTES: &[u8] = include_bytes!("../../assets/icon/icon_256.png");
+
+    let pixmap = match tiny_skia::Pixmap::decode_png(ICON_BYTES) {
+        Ok(p) => p,
+        Err(e) => {
+            eprintln!("warn: could not decode embedded window icon PNG: {e}");
+            *applied = true; // don't retry every frame
+            return;
+        }
+    };
+    let rgba = pixmap.data().to_vec();
+    let icon = match winit::window::Icon::from_rgba(rgba, pixmap.width(), pixmap.height()) {
+        Ok(i) => i,
+        Err(e) => {
+            eprintln!("warn: could not construct window icon: {e}");
+            *applied = true;
+            return;
+        }
+    };
+    window_wrapper.set_window_icon(Some(icon));
+    *applied = true;
+}
+
 /// Wraps the default panic hook with one that also appends a crash log
 /// to `<data_dir>/crash.log` (next to `settings.json`). The default hook
 /// still runs afterwards, so stderr output and debugger integration are