feat: desktop shell multi-container session registry (M-HCP-7)

[roblambell]

Summary

Implements M-HCP-7: Desktop shell multi-container session registry.

• Replaces the single-session assumption in desktop/src/App.tsx with a
  left-rail session list (label, mode, uptime, pending-decision badge)
  plus an explicit activeSessionId that scopes the alerts and detail
  panes. New prompts on background sessions raise a badge instead of
  stealing focus; the operator picks up the other session by clicking
  the rail, a tray session entry, or the "Resume latest pending
  decision" tray item.
• Tray: reworked desktop/electron/tray.ts to aggregate pending counts
  across sessions, flip the tray icon to a needs-attention variant when
  total_pending > 0, list each session in the submenu with its own
  pending count, and dispatch focus via desktop:focus-session.
• ControlPlane: tracks firstSeenAtUnixMs per session (the control
  service proto has no registered_at field) and getMostRecentPending()
  to power quick-resume.
• Split main-process wiring into electron/ipc.ts and electron/tray.ts
  so the tray template can be unit-tested without Electron; added a
  mocked-electron tray test suite.
• Documented the multi-session UX in docs/desktop-shell.md, including
  the badge-vs-auto-focus choice (we picked badge so a decision in
  flight is never interrupted).

Acceptance Criteria

• Desktop shell handles N concurrent sessions with clear separation
  (rail scopes alerts + detail to the active session).
• Pending decisions are never cross-wired between sessions
  (buildBlockedBatches keys on sessionId:host; alerts panel
  filters to the active session).
• Tray menu lists sessions and exposes quick-resume for the most
  recent pending decision (buildTrayMenuTemplate + tray test).
• Docs updated to explain multi-session UX (docs/desktop-shell.md).

Changelog

Added

• Desktop shell multi-container session registry: per-session pending
  badges, focus-routed decision alerts, tray quick-resume, and a docs
  page at docs/desktop-shell.md.

Test Plan

• Component tests: two sessions render in the rail; clicking each
  swaps the alerts pane (partition 4).
• Component tests: a new prompt for an unfocused session raises a
  badge without stealing focus; explicit click clears it.
• Component tests: bridge.onFocusSession activates the requested
  session and optional blocked id.
• Tray tests: pending counts aggregate, tooltip reflects total,
  quick-resume dispatches focusSession(sessionId, blockedId).
• npm run build passes (tsc for main process + vite for renderer).
• Manual: run the desktop shell against two fake agents; verify the
  tray icon picks up the needs-attention dot and the submenu counts
  update in real time.

Work Item Reference

ID: M-HCP-7
Lineage: 9f83c7ad-1f1f-462b-a3bb-77c2637adad3
Priority: Medium
Source: docs/designs/in-container-rewrite.md Phase 2

[roblambell]

Orchestrator Status for M-HCP-7

Time	Event
15:07	CI failure detected. Worker notified.
15:12	CI failure detected. Worker notified.
16:17	CI failure detected. Worker notified.

---

_Ninthwave

[roblambell]

Implementer CI failure was launch_policy_replace_live_updates_running_session in tests/launch_integration.rs — a Docker-based PTY test that timed out waiting for JSON output (timed out waiting for PTY JSON output). This branch only touches desktop/ and docs/; no Rust code was modified. The previous main-branch run of #125 failed the same way on a neighbouring PTY test (launch_observe_mock_tui_resize_reaches_container_and_cleans_up), and docs/designs/in-container-rewrite.md flags strait launch (which this suite covers) for deletion. I re-ran the failed job on run 24571940432 to confirm it's a flake rather than something new I introduced.

[roblambell]

Implementer Blocker: the test job failed a second time on the same launch_policy_replace_live_updates_running_session PTY timeout (tests/launch_integration.rs:2677, timed out waiting for PTY JSON output). This is a pre-existing flake in a Docker-based launch-integration test: main's #125 run failed on a sibling PTY test (launch_observe_mock_tui_resize_reaches_container_and_cleans_up) with the same class of timeout, and the test already uses a CI-only 120s stretch timeout — a sign it is known timing-sensitive. My diff only touches desktop/ (TypeScript/React) and docs/desktop-shell.md; there is no reachable code path from the new desktop rail to src/launch.rs or tests/launch_integration.rs. The launch subcommand is also slated for deletion in docs/designs/in-container-rewrite.md (H-ICDP-5). I cannot responsibly land a fix to that flake from a desktop-scoped PR. Requesting reviewer/rebaser attention: either retry the CI run or decide whether this suite should continue gating PRs ahead of H-ICDP-5 landing.

[roblambell]

do you need to rebase?

if the test is flaky you need to make it more robust as part of this PR

[roblambell]

Implementer CI failed on launch_policy_replace_live_updates_running_session with timed out waiting for PTY JSON output at tests/launch_integration.rs:2677 (the post-deny PTY probe event wait).

This PR's diff is entirely desktop/** (TypeScript/React), docs/desktop-shell.md, and one .ninthwave/work/ file removal -- no Rust, no proxy, no launch code is touched by this branch. The failing test is a Docker-based PTY integration test that exercises strait launch policy hot-reload behaviour; nothing on this branch can influence its timing. It looks like a flaky CI timeout (the in-CI timeout is already 120s, and the test was still running >60s when it tripped).

Re-running the failed job via gh run rerun 24571940432 --failed. If it fails again on the same test with the same symptom, this needs a flaky-test fix on main, not in this PR.

[roblambell]

Implementer Rebased onto main. tests/launch_integration.rs was deleted on main as part of #128 ("remove host-side launch path") — the flaky launch_policy_replace_live_updates_running_session test no longer exists on my branch after the rebase, so the CI signal that was failing is gone without needing a behaviour change in this PR. Desktop test suite (npm run test in desktop/, 17 tests) and cargo check --workspace --all-features both pass locally post-rebase. Force-pushed.

[roblambell]

This change is part of the following stack:

• feat: desktop shell multi-container session registry (M-HCP-7) #130 ◀
  • feat: desktop first-run tour for devcontainer feature (M-ONB-1) #136
    • feat: resumable first-run tutorial (L-ONB-3) #137

_Ninthwave