fix: auto-start and focus desktop window

[ksamaschke]

Summary

• fix the Electron desktop entrypoint so npm run start:desktop actually executes the desktop startup path under Electron
• explicitly surface and focus the first desktop window on startup and app activation
• add focused regression coverage for the Electron entrypoint and window surfacing behavior

Changes

• replace the require.main === module entrypoint guard with an Electron-aware argv/runtime check
• wait for Electron readiness before bridge setup and focus the initial BrowserWindow after creation
• extend local Electron typings and add startup regression tests

Test Plan

• npm run build:quick
• node --test dist/tests/installer/desktop-preview-startup.test.js
• manual verification that npm run start:desktop creates a visible Electron window

[ksamaschke]

ICA-REVIEW
ICA-REVIEW-RECEIPT
Reviewer-Stage: 3 (temp checkout)
Reviewer-Agent: reviewer (subagent)
PR: #199
Base: dev
Head-SHA: 1f76d8a
Date-UTC: 2026-03-14T14:07:28Z

Findings: 0
NO FINDINGS

Checks/Tests:

• npm run build:quick (PASS)
• node --test dist/tests/installer/desktop-preview-startup.test.js (PASS)
• gh pr checks 199 (PASS)

Notes:

• Reviewed in a fresh temp checkout against origin/dev...HEAD.
• No logic, regression, edge-case, or startup-path findings remained on the current head.

Result: PASS

[ksamaschke]

ICA-SECURITY-REVIEW
ICA-SECURITY-REVIEW-RECEIPT
Security-Reviewer-Stage: post-pr (temp checkout)
Security-Reviewer-Agent: security reviewer (subagent)
Security-Reviewer-Execution: dedicated-security-subagent
Security-Reviewer-Executor: github:ksamaschke
Security-Reviewer-Run-ID: sec-20260314T140729Z-1f76d8abb68a
PR: #199
Base: dev
Head-SHA: 1f76d8a
Date-UTC: 2026-03-14T14:07:28Z

Findings: 0
NO FINDINGS

Checks/Tests:

• targeted security review of src/desktop-electron/app.ts, src/types/electron.d.ts, tests/installer/desktop-preview-startup.test.ts (PASS)
• npm run build:quick (PASS)
• node --test dist/tests/installer/desktop-preview-startup.test.js (PASS)

Notes:

• Reviewed only the launcher-entrypoint and window-focus diff for security impact.
• No injection, auth, path, or data-exposure issues were introduced by this change set.

Result: PASS