fix(launcher-standard): resolve 3 cross-doc contradictions (#170)

## Summary

The launcher standard (`docs/UX-standards/launcher-standard.adoc` +
`launcher/launcher-standard.a2ml`) and the lifecycle standard
(`docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc`) disagreed on three
points. Each was a real contradiction — not stylistic drift — and would
have left a downstream implementer unsure which doc to follow.

- **`--browser` was listed as an independent required mode** in the a2ml
  while prose calls it an alias for `--auto`. Split `[required-modes]`
  (canonical only) from a new `[aliases]` table mapping
  `--browser`/`--web` → `--auto`. Same enforcement, cleaner taxonomy.
- **`--integ` / `--disinteg` supersede the standalone install/uninstall
scripts** (per launcher-standard.adoc v0.2.0), but LM-LA never absorbed
  the change. Added `IMPORTANT` callouts to §Installation Standard and
  §Uninstallation Standard scoping the script templates as reference for
  what `--integ` / `--disinteg` must do internally, and marking the
  standalone scripts optional when those modes exist.
- **`sudo` violation**: launcher-standard.adoc design principle 5
forbids
elevated privileges, but the LM-LA templates ran `sudo dnf`, `sudo cp`,
  `sudo systemctl`. Added a "Privilege model" callout: sudo paths are
opt-in platform-maintainer extensions for machine-wide deployment only;
a launcher's `--integ` MUST NOT invoke them without explicit `--system`
  opt-in. Missing deps under a user install fail with an actionable
  message, not escalate.

Spec version bumped 0.2.0 → 0.3.0 (taxonomy change in
`[required-modes]`;
behaviour for compliant launchers is unchanged because every accepted
input is still accepted).

## Out of scope (follow-ups identified but deferred)

Surfaced during the same review, not bundled here so this PR stays
small enough to read:

- No CI gate enforcing the prose↔a2ml lock-step requirement stated in
  `launcher/README.adoc:37-39`.
- Hard-coded `/var/mnt/eclipse/repos/...` paths in the a2ml fallback and
  `.desktop` examples — breaks on non-eclipse hosts.
- Browser launcher missing macOS `open`, WSL `wslview`, `\$BROWSER`.
- `wait_for_server` flat-1s polling ignores the
  `wait-for-url-timeout-seconds` constant the a2ml already declares.
- PID/log under predictable `/tmp/` names — symlink-attack target on
  shared hosts; should use `\$XDG_RUNTIME_DIR` / `\$XDG_STATE_HOME`.
- `keepopen.sh` doesn't honour `NO_COLOR`.
- `gui-dialog-chain` and `[soft-attach]` declared in a2ml without
  reference impl → every downstream launcher will reinvent.
- `--version` mode missing entirely from required-modes.

Happy to take any of these in follow-up PRs.

## Test plan

- [x] AsciiDoc renders (visual diff — only added `[IMPORTANT]` blocks
and one bullet)
- [x] a2ml parses (additive `[aliases]` table + literal-string list
shortening)
- [ ] Downstream `launch-scaffolder` rebuild picks up the new
`[aliases]` table (separate repo)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc

@@ -55,6 +55,41 @@ and warmup procedures for different user types.
 
 == Installation Standard (LM/LA-INSTALL)
 
+[IMPORTANT]
+.Relationship to `launcher-standard.adoc` `--integ` / `--disinteg`
+====
+As of `launcher-standard.adoc` v0.2.0, the *typical* install path for a
+hyperpolymath launcher is the launcher's own `--integ` mode, and removal
+is `--disinteg`. When a launcher implements those modes, a separate
+`scripts/install.sh` / `scripts/uninstall.sh` is **no longer required**.
+
+This document remains authoritative for **what** must happen during install
+and uninstall (the desktop file, the icon, the integrity hashes, what to
+preserve on removal, etc.). `launcher-standard.adoc` is authoritative for
+**where** those operations are triggered from (the launcher binary itself).
+
+The script-based templates in this section are the reference for what
+`--integ` / `--disinteg` must accomplish internally — they are not a
+parallel, separately-invoked install surface.
+====
+
+[IMPORTANT]
+.Privilege model — user-level by default
+====
+Both `--integ` and the templates below MUST be runnable without elevated
+privileges. All paths default to the user's home (`~/.local/share`,
+`~/.config`, `~/.local/bin`), matching `launcher-standard.adoc` §System
+Integration Modes design principle 5 (*"No elevated privileges. No sudo."*).
+
+`sudo` calls appear in the §Platform Maintainer Warmup template and in
+the optional dependency-bootstrap path below. These are **opt-in extensions
+for platform maintainers performing a machine-wide deployment** — they MUST
+NOT run as part of a default per-user install, and a launcher's `--integ`
+MUST NOT invoke them without explicit `--system` opt-in. If a dependency
+is missing under a user install, the correct response is to fail with an
+actionable error message, not to escalate.
+====
+
 === Requirements
 
 Launchers and applications MUST provide:
@@ -63,6 +98,7 @@ Launchers and applications MUST provide:
    - Named: `<app-name>-install.sh`
    - Location: `<repo-root>/scripts/install.sh`
    - Permissions: `755` (executable)
+   - **Optional** when the launcher implements `--integ` / `--disinteg`.
 
 2. **Idempotent Operations**
    - Safe to run multiple times
@@ -352,6 +388,16 @@ log "✓ Platform setup complete!"
 
 == Uninstallation Standard (LM/LA-UNINSTALL)
 
+[IMPORTANT]
+.See §Installation Standard
+====
+The same `--integ`/`--disinteg` supersedence and user-level-privilege rules
+apply here. When the launcher implements `--disinteg`, a separate
+`scripts/uninstall.sh` is not required; the template below is the reference
+for what `--disinteg` must accomplish. `sudo` paths are opt-in
+platform-maintainer extensions and MUST NOT run by default.
+====
+
 === Uninstall Script Requirements
 
 [source,bash]

launcher/launcher-standard.a2ml

@@ -15,8 +15,8 @@
 #   - standards/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc (install/uninstall)
 
 [spec]
-version = "0.2.0"
-date = "2026-04-17"
+version = "0.3.0"
+date = "2026-05-26"
 compliance = [
     "launcher-standard.adoc",
     "LM-LA-LIFECYCLE-STANDARD.adoc",
@@ -44,7 +44,9 @@ final-shell       = "bash -l at REPO_DIR (never 'press enter to close')"
 
 [required-modes]
 # These are the modes every compliant launcher MUST implement.
-runtime = ["--start", "--stop", "--status", "--auto", "--browser"]
+# Aliases (see [aliases] below) are not listed here — they are accepted
+# inputs, not independent obligations.
+runtime = ["--start", "--stop", "--status", "--auto"]
 integration = ["--integ", "--disinteg"]
 meta = ["--help", "--version"]
 
@@ -61,6 +63,12 @@ example          = "aerie-launcher 0.4.2 (a1b2c3d) [linux-x86_64]"
 exit-code        = 0
 machine-greppable = true
 
+[aliases]
+# Documented mode aliases. Launchers MUST accept these and route them to
+# the canonical mode. Prose: launcher-standard.adoc §Required Modes.
+"--browser" = "--auto"
+"--web"     = "--auto"
+
 [optional-modes]
 # Modes launchers MAY implement for extra functionality.
 developer = ["--debug", "--logs", "--tail"]