This is obviously a requirement for #5374, oops :^)
Also handle errors gracefully, opening a file that isn't PixelPaint JSON
would previously crash.
Closes#5388.
Now that WindowServer broadcasts the system theme using an anonymous
file, we need clients to pledge "recvfd" so they can receive it.
Some programs keep the "shared_buffer" pledge since it's still used for
a handful of things.