fix(gui): strip host LD_LIBRARY_PATH from packaging + defensive GPU/icon fixes

Root cause of the packaged GUI crashing with SIGSEGV inside ld.so on user
machines (segfault at fixed +0x1ff36, undefined symbols nspr_use_zone_allocator
/ localtime64): the build host had LD_LIBRARY_PATH polluted by a third-party
runtime (/opt/cangjie), which electron-builder baked into the produced binary's
dependency resolution. Clean machines without that library then fail in the
dynamic loader before any app code runs.

- Makefile: every gui-* pack target now runs under `env -u LD_LIBRARY_PATH`
- main.js: app.disableHardwareAcceleration() before ready (avoids the common
  Chromium GPU-process SIGSEGV on hybrid-GPU/Wayland Linux hosts)
- main.js: window icon reads from process.resourcesPath (real file, not asar)
  — asar-path icons are a known GTK segfault source on Linux

Makefile

@@ -9,6 +9,12 @@ export GUI_DIR
 GUI_DIR=cmd/gui
 VERSION ?= $(shell git describe --tags --dirty 2>/dev/null || echo "0.1.0")
 
+# Clean env for GUI packaging: the host may have LD_LIBRARY_PATH polluted by
+# third-party runtimes (e.g. /opt/cangjie) which electron-builder bakes into
+# the produced binary's DT_RPATH/dep resolution -> the packaged app then
+# SIGSEGVs inside ld.so on clean machines.  Strip it for every pack step.
+CLEAN_PACK_ENV = env -u LD_LIBRARY_PATH
+
 all: build
 
 # ---- core binary (server users / embedded core) ----
@@ -26,23 +32,25 @@ gui-dev:
 
 # build the embedded core into the GUI, then run electron-builder
 # targets: deb + AppImage (linux), rpm needs system rpmbuild
+# NOTE: run in a clean env (no LD_LIBRARY_PATH pollution) so the packaged
+# binary does not link against host-only libs and crash on user machines.
 gui-dist:
-	@cd $(GUI_DIR) && npm run dist:linux
+	@cd $(GUI_DIR) && $(CLEAN_PACK_ENV) npm run dist:linux
 
 # deb only (for local sharing), rpm needs rpmbuild
 gui-deb:
-	@cd $(GUI_DIR) && npm run dist:debian
+	@cd $(GUI_DIR) && $(CLEAN_PACK_ENV) npm run dist:debian
 
 # windows nsis installer: host-built core (needs apt install gcc-mingw-w64-x86-64 + wine)
 gui-win:
-	@cd $(GUI_DIR) && npm run dist:win
+	@cd $(GUI_DIR) && $(CLEAN_PACK_ENV) npm run dist:win
 
 # windows nsis installer: full cross-build in docker (self-sufficient, no host mingw)
 gui-win-docker:
-	@cd $(GUI_DIR) && ./scripts/dist-win-docker.sh
+	@cd $(GUI_DIR) && $(CLEAN_PACK_ENV) ./scripts/dist-win-docker.sh
 
 gui-dist-dir:
-	@cd $(GUI_DIR) && npm run dist:dir
+	@cd $(GUI_DIR) && $(CLEAN_PACK_ENV) npm run dist:dir
 
 test:
 	go test ./...