[codex] fix desktop update packaging integrity

[wizzoapp]

Supersedes #96 for ADA-55 after the original PR exhausted Codex review allowance.

Summary

• Keep main's compact desktop package/prune model and layer the ADA-55 packaged runtime integrity check on top.
• Stage the packaged desktop entrypoint through bootstrap.cjs, write packaged-integrity-manifest.json after app.asar.unpacked pruning, and verify the unpacked sidecar closure before loading main.cjs.
• Preserve update-smoke robustness from the old branch: mock update host uses 127.0.0.1, staging temp paths are canonicalized, and launch-smoke fatal diagnostics retain bounded first-fatal snapshots.

Validation

• Factory pre-commit gate passed on every replayed commit: vp check, vp run --cache typecheck, Codex gpt-5.5 autoreview clean.
• node_modules/.bin/vp check passed with existing unrelated unused-import warnings.
• node_modules/.bin/vp run typecheck passed.
• node_modules/.bin/vp test run scripts/desktop-launch-smoke.test.mjs scripts/desktop-after-pack-prune.test.mjs apps/desktop/src/app/PackagedIntegrity.test.ts scripts/build-desktop-artifact.test.ts apps/desktop/src/updates/DesktopUpdates.test.ts apps/desktop/src/updates/updateMachine.test.ts apps/web/src/components/desktopUpdate.logic.test.ts passed: 7 files, 93 tests.
• Recycled PR [codex] fix desktop update packaging integrity #96 was green on CI run 28941505453, including Desktop Linux Package Smoke and Desktop Windows Package Smoke.

Guardrail

The old base has no apps/desktop/src/app/PackagedIntegrity.ts and still stages apps/desktop/dist-electron/main.cjs as the packaged entrypoint. The new tests assert manifest generation after pruning and bootstrap entrypoint wiring, so the ADA-55 guardrail fails on the old behavior and passes on this branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13fe6ba3d0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73331d6cee

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 150f6c0cbe

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[adamfgr]

Auto-approved by wizzo-approve: all policy conditions verified against HEAD fc26cdd.