fix: guard unset HOME in desktop-entry cmake script and correct plan verification

Two code-review findings:

1. Add a guard in cmake/install_desktop_entry.cmake that fails visibly when both
   XDG_DATA_HOME and HOME are unset or empty, preventing silent installation to
   the filesystem root in minimal CI sandboxes.

2. Replace the plan's tail-based verification with grep, because cmake's
   FATAL_ERROR message and ninja's "build stopped" lines push the actual
   rejection message out of the last four lines. The grep command reliably finds
   the expected "desktop-file-validate rejected" string.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md

@@ -1030,13 +1030,13 @@ cp data/org.udpscope.app.desktop.in /tmp/entry-backup.in
 sed -i 's/^Type=Application$/Type=Nonsense/' data/org.udpscope.app.desktop.in
 cmake -S . -B build -G Ninja >/dev/null
 cmake --build build --target desktop-entry >/tmp/de.log 2>&1; echo "--- exit=$?"
-tail -4 /tmp/de.log
+grep "desktop-file-validate rejected" /tmp/de.log
 cp /tmp/entry-backup.in data/org.udpscope.app.desktop.in
 cmp /tmp/entry-backup.in data/org.udpscope.app.desktop.in && echo "restore exact"
 rm /tmp/entry-backup.in /tmp/de.log
 ```
 
-Expected: a **non-zero** `exit=`, `desktop-file-validate rejected ...` in the tail, and
+Expected: a **non-zero** `exit=`, the `grep` printing the `desktop-file-validate rejected` message, and
 `restore exact`. If `exit=0` the `RESULT_VARIABLE` check is wrong. The file is untracked at this
 point, so `git diff` cannot verify the restore — `cmp` against the backup is what can.