Give Settings its own icon and the first dock slot

Panama Settings shipped with Icon=preferences-system-symbolic, a
monochrome glyph drawn for 16px toolbar use. Beside full-colour
application icons in a 48px dock it reads as a missing icon rather than
a quiet one. It now has its own: a gear, because a settings icon has to
be recognisable before it is clever, rendered in the Prism gradient on
the dark tile so it belongs to this desktop.

An earlier attempt drew the gear as a ring with radial strokes; at dock
size the strokes merged into the ring and it read as an X. The shipped
version is a real toothed outline, checked at 48px rather than only at
128.

The dock also pinned GNOME Settings first. Panama now covers what GNOME
Settings did for this desktop and delegates the remainder to it by name,
so pinning the thing it delegates TO put the fallback in front of the
real one. GNOME Settings stays installed and searchable.

link-dotfiles installs icons alongside desktop entries, so this survives
a fresh setup rather than being a file that happens to exist here.

The new contract asserts every pinned application resolves to an
installed desktop entry. DockBody drops an unresolvable pin rather than
drawing a broken icon, which is right at runtime and invisible to debug:
a typo or a renamed desktop id just removes an icon with nothing logged.
It also cost me a false negative while writing it -- DesktopEntries
populates asynchronously, and asking too early reports every pin as
missing.

Also makes tests/quickshell/osd-ui-contract.sh executable. It was
committed mode 644, the only test in the suite that was, so the runner
could not invoke it. It passes.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

tests/quickshell/dock-pins-contract.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Every pinned application must resolve to an installed desktop entry.
+#
+# DockBody drops a pin it cannot resolve rather than drawing a broken icon,
+# which is the right behaviour at runtime and a terrible one to debug: a typo in
+# the shipped list, or an application that changed its desktop id, simply
+# removes an icon from the dock with nothing logged.
+#
+# Also asserts the Settings entry resolves and carries Panama's own icon, since
+# it is the first pin and the one most likely to be wrong after a rename.
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+harness="$repo_dir/config/dot/quickshell/dock-pin-harness.qml"
+config_home="$(mktemp -d /tmp/panama-dockpins.XXXXXX)"
+
+fail() {
+    printf 'dock pins contract: %s\n' "$1" >&2
+    exit 1
+}
+
+run() { XDG_CONFIG_HOME="$config_home" qs -p "$harness" "$@"; }
+harness_pid=""
+
+cleanup() {
+    # By PID, never `pkill -f dock-pin-harness`: that pattern also matches the
+    # shell running this script.
+    [[ -n "$harness_pid" ]] && kill "$harness_pid" >/dev/null 2>&1 || true
+    rm -rf "$config_home"
+}
+trap cleanup EXIT
+
+XDG_CONFIG_HOME="$config_home" qs -p "$harness" --daemonize >/dev/null
+for _ in $(seq 1 40); do
+    run ipc show 2>/dev/null | rg -q '^target dock-pin-test$' && break
+    sleep 0.1
+done
+run ipc show 2>/dev/null | rg -q '^target dock-pin-test$' || fail 'test IPC target did not start'
+harness_pid="$(run list | awk '/Process ID:/ { print $3; exit }')"
+
+# DesktopEntries populates asynchronously; asking before it has finished reports
+# every pin as missing, which is a false failure rather than a real one.
+loaded=0
+for _ in $(seq 1 60); do
+    loaded="$(run ipc call dock-pin-test count 2>/dev/null || printf 0)"
+    [[ "$loaded" =~ ^[0-9]+$ ]] && (( loaded > 0 )) && break
+    sleep 0.25
+done
+(( loaded > 0 )) || fail 'no desktop entries were discovered at all'
+
+state="$(run ipc call dock-pin-test resolve)"
+
+missing="$(jq -r '.missing | join(", ")' <<<"$state")"
+[[ -z "$missing" ]] || fail "these pinned applications do not resolve and would vanish from the dock: $missing"
+
+jq -e '.first.id == "panama-settings" and .first.found == true' <<<"$state" >/dev/null \
+    || fail "Panama Settings is not the first pin, or does not resolve: $(jq -c .first <<<"$state")"
+jq -e '.first.icon == "panama-settings"' <<<"$state" >/dev/null \
+    || fail "Settings is not using Panama's own icon: $(jq -r .first.icon <<<"$state")"
+
+icon="$HOME/.local/share/icons/hicolor/scalable/apps/panama-settings.svg"
+[[ -r "$icon" ]] || fail "the icon it names is not installed at $icon"
+
+trap - EXIT
+cleanup
+printf 'dock pins contract: PASS (%s pins, all resolve)\n' "$(jq -r .total <<<"$state")"