App commands and --ha-remove (iteration 2, step 6)

The platform accepts app commands (D43): flags that get a
QCoreApplication like the manifest commands and run prepare() and then
the new hook runCommand(). The app's --ha-remove clears the device's
retained topics, so HA deletes the device; uninstall.sh runs it after
stopping the app and before unregistering from SteamVR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DESIGN.md

@@ -385,6 +385,8 @@ a `QGuiApplication` (no display needed, works over SSH), and `exec()` calls
 - `exec()`: after the manifest check, an app command runs `prepare()` and then a new hook
   `virtual int runCommand(const QString& name)`, whose result is the exit code. No engine,
   surfaces or SteamVR.
+- The mode is `DashboardMode::Command` (so `prepare()` can tell); the name of the first app
+  command given goes to `runCommand()`. Tested in `tst_surfaces` (`surfaces_command`).
 - Moving the manifest commands onto this mechanism is possible later, not part of iteration 2.
 
 ### `--ha-remove`
@@ -396,7 +398,11 @@ delete).
 - An app command (D43): loads the settings, connects, publishes **empty retained payloads**
   to discovery (HA then deletes the device and its entities), device availability, and each
   entity's state and availability topics; disconnects.
-- Exit code 0 on success; ≠ 0 with a warning if the broker can't be reached within 10 s.
+- Its client uses the client id `frameassistant_<device id>_remove` (doesn't knock a running
+  instance off the broker) and no will. The `HaDevice` is created only after the connection
+  is up: a device that sees the connection come up publishes itself first.
+- Exit code 0 on success; 1 with an error if the broker can't be reached within 10 s, or the
+  removal isn't acknowledged within 10 s.
 - `uninstall.sh`: `pkill` → `sleep 1` → `--ha-remove` (a failure doesn't stop the uninstall) →
   `--uninstall-manifest`.
 - Also usable by hand, e.g. after a device name change without `ha_unique_id`: