seed_session: home_guard is a desktop Firebase consumer too

The fifth gatelock sibling (github.com/kuhyx/home-guard) calls
firebase_client_for("home_guard") from its systemd-run gate, so it needs
~/.config/home_guard/firebase_auth.json seeded like every other daemon.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crdt-sync/crdt_sync/tests/test_tool_seed_session_main.py

@@ -51,6 +51,12 @@ def test_todo_is_among_the_default_apps() -> None:
     assert "todo" in ss.DEFAULT_APPS
 
 
+def test_home_guard_is_among_the_default_apps() -> None:
+    """The fifth gatelock sibling; ``home_guard._sync_client`` calls
+    ``firebase_client_for("home_guard")`` from the systemd-run gate."""
+    assert "home_guard" in ss.DEFAULT_APPS
+
+
 def test_a_single_app_can_be_selected() -> None:
     """--app narrows the run, which is what a rerun after a failure uses."""
     with (

crdt-sync/tool/seed_session.py

@@ -41,14 +41,13 @@ from crdt_sync._firebase_auth import FirebaseAuthError, FirebaseTokenProvider
 from crdt_sync._remote import RemoteSyncError
 
 # Importable as a package module (tool/__init__.py exists) so the loopback
-# OAuth flow is shared rather than reimplemented.
+# OAuth flow is shared, not reimplemented.
 from tool.google_id_token import TokenError, fetch_id_token
 
 # Every app that calls firebase_client_for/mirror_client_for from the desktop,
 # and so keeps a refresh token under ~/.config/<app>/. Named here rather than
-# discovered from ~/.config, because a missing directory is exactly the case
-# that needs seeding -- discovery would skip the app that needs this most.
-#
+# discovered from ~/.config: a missing directory is exactly the case that
+# needs seeding, so discovery would skip the app that needs this most.
 # The remaining Flutter-only apps (home_inventory, workout_app) are absent on
 # purpose: they authenticate in-app on the phone and have no desktop session.
 # `todo` used to be grouped with them, but it grew a real desktop wrapper
@@ -63,9 +62,9 @@ from tool.google_id_token import TokenError, fetch_id_token
 # Re-derive rather than guess when adding one; a repo-by-repo sweep missed two
 # of these. Grep all of ~ for the string literal passed to firebase_client_for,
 # mirror_client_for and credential_store_for across every *.py. That still
-# misses call sites passing a constant -- wake_alarm goes through
-# wake_alarm._constants.SYNC_APP_NAME -- so check those by name too. "interop"
-# is tool/interop_seed.py's own scratch store, not an app.
+# misses call sites passing a constant (wake_alarm._constants.SYNC_APP_NAME,
+# home_guard._constants.APP_NAME), so check those by name too. "interop" is
+# tool/interop_seed.py's own scratch store, not an app.
 DEFAULT_APPS = (
     "diet_guard",
     "wake_alarm",
@@ -73,6 +72,7 @@ DEFAULT_APPS = (
     "byox_ladder",
     "leetcode_guard",
     "todo",
+    "home_guard",
 )
 
 # A fixed default so the redirect URI is stable enough to register once on the