refactor: capabilities - add unified launch routine

programs/src/desktop/desktop_catalog.cpp

@@ -30,11 +30,8 @@ int desktop_spawn_app(DesktopState* ds, const char* path, const char* args) {
     // The grant table decides what each program may receive; the kernel bounds
     // it by what this session was actually delegated, so a non-admin session
     // clamps to nothing without the desktop having to decide that itself.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, montauk::caps::self_delegable());
-    // Applications inherit the desktop's kernel-owned owner identity.  An
-    // explicit user override is reserved for trusted session creators.
-    return montauk::spawn_with_caps(path, args, nullptr, caps);
+    // Applications inherit the desktop's kernel-owned owner identity.
+    return montauk::caps::launch(path, {.args = args});
 }
 
 int desktop_list_item_indices(DesktopState* ds,