fix: guard unset HOME in desktop-entry cmake script and correct plan verification

Two code-review findings:

1. Add a guard in cmake/install_desktop_entry.cmake that fails visibly when both
   XDG_DATA_HOME and HOME are unset or empty, preventing silent installation to
   the filesystem root in minimal CI sandboxes.

2. Replace the plan's tail-based verification with grep, because cmake's
   FATAL_ERROR message and ninja's "build stopped" lines push the actual
   rejection message out of the last four lines. The grep command reliably finds
   the expected "desktop-file-validate rejected" string.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmake/install_desktop_entry.cmake

@@ -16,6 +16,14 @@ else()
   set(data_home "$ENV{HOME}/.local/share")
 endif()
 
+# Fail visibly if both fallback paths are unusable. The script needs a directory to install into;
+# a missing $HOME in a sandboxed CI environment should not silently install to the filesystem root.
+if(NOT DEFINED ENV{XDG_DATA_HOME} OR "$ENV{XDG_DATA_HOME}" STREQUAL "")
+  if(NOT DEFINED ENV{HOME} OR "$ENV{HOME}" STREQUAL "")
+    message(FATAL_ERROR "XDG_DATA_HOME and HOME are both unset or empty; cannot determine install directory")
+  endif()
+endif()
+
 set(apps_dir "${data_home}/applications")
 set(icon_dir "${data_home}/icons/hicolor/scalable/apps")
 set(sym_dir "${data_home}/icons/hicolor/symbolic/apps")

docs/superpowers/plans/2026-10-04-app-icon-and-desktop-entry.md

@@ -1030,13 +1030,13 @@ cp data/org.udpscope.app.desktop.in /tmp/entry-backup.in
 sed -i 's/^Type=Application$/Type=Nonsense/' data/org.udpscope.app.desktop.in
 cmake -S . -B build -G Ninja >/dev/null
 cmake --build build --target desktop-entry >/tmp/de.log 2>&1; echo "--- exit=$?"
-tail -4 /tmp/de.log
+grep "desktop-file-validate rejected" /tmp/de.log
 cp /tmp/entry-backup.in data/org.udpscope.app.desktop.in
 cmp /tmp/entry-backup.in data/org.udpscope.app.desktop.in && echo "restore exact"
 rm /tmp/entry-backup.in /tmp/de.log
 ```
 
-Expected: a **non-zero** `exit=`, `desktop-file-validate rejected ...` in the tail, and
+Expected: a **non-zero** `exit=`, the `grep` printing the `desktop-file-validate rejected` message, and
 `restore exact`. If `exit=0` the `RESULT_VARIABLE` check is wrong. The file is untracked at this
 point, so `git diff` cannot verify the restore — `cmp` against the backup is what can.