fix(tauri): make game-directory changes observable

Game-directory selection could reach update_game_directory and then fail before
peer startup, while the frontend only logged the rejected invoke. Preserve the
last accepted root until peer acknowledgement, surface backend rejection in
the settings and main-window UI, and avoid holding the published control lock
across runtime replies. Startup preflight remains fail-closed; synchronous
setup stays lexically owned through scoped_blocking so cancellation cannot
strand a partially published runtime.

Add peer-cli scenario S50 to verify invalid changes preserve the existing
library and valid changes acknowledge and refresh the library in both
directions. Modernize the fixed-size hex decoders to satisfy the current
workspace Clippy lint without changing their behavior.

Test Plan:
- `just fmt` -- passed
- `just clippy` -- passed
- `just test` -- passed
- `just frontend-test` -- passed
- `deno task build` -- passed
- `just peer-cli-tests S50` -- passed
- `just build` -- passed
- `git diff --cached --check` -- passed

organize/testing/PEER_CLI_SCENARIOS.md

@@ -57,6 +57,7 @@ for deterministic local runs; mDNS/macvlan remains an environment smoke path.
 | S47 | Multi-archive streamed install order             | Source and client run alone on an internal network using `fixture-multi/cnctw`, with two root `.eti` archives named to require sorted processing.                                                                                                                                                                                                                 | The client roster/raw view carry the exact multi-profile `ContentId`, and every verified file is bound to the named source's authenticated `PeerId`. Paths arrive in root archive sort order, both payloads install under `local/`, final state is local-only installed, and no root archive/sentinel is committed.                                                                                                                                                                                                                                                                                                                                                                                            |
 | S48 | Call to Play direct-author late join             | Alice creates a call; Bob publishes RSVP/chat intents against its generated `CallId`. Alice and Bob remain connected while Charlie starts on a separate internal-only Docker network shared with Alice; Bob joins it only after Charlie's first pull.                                                                                                             | Alice retains the exact Bob-inclusive view before and after Charlie's first pull, while Charlie's authenticated peer set is exactly Alice and its replacement contains only Alice's generated event ID. After the direct Bob pull it contains the exact three-event union once. Bob's departure converges to exactly Alice plus the creator event; Alice's departure then converges to an empty peer set and view.                                                                                                                                                                                                                                                                                             |
 | S49 | Terminal Call to Play direct-author late join    | Alice creates and later starts a call; Bob publishes ready/chat intents. Alice and Bob remain connected while Charlie first pulls Alice across an internal-only Docker network, then Bob joins that network for a direct pull.                                                                                                                                    | Alice retains the exact four-event view throughout the first pull; Charlie is authenticated only to Alice and sees create/start without Bob-owned IDs. Pulling Bob produces the exact four-event terminal view once; creator departure removes the complete call after bounded liveness convergence while Charlie's authenticated peer set remains exactly Bob.                                                                                                                                                                                                                                                                                                                                                |
+| S50 | Game-directory acknowledgement and recovery      | A peer starts with catalog game `ggoo`, rejects a missing directory, then switches to a second valid directory containing the same game and switches back.                                                                                                                                                                                                        | The missing-directory command returns an explicit error and leaves the previous local library unchanged. Each valid change returns the exact accepted canonical path and emits a refreshed `local-library-changed` snapshot, proving the configured root is actually committed in both directions.                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ## Version-Skew Contract