fix(desktop): recover from main Renderer loss

[M4n5ter]

Summary

English

Detect unexpected termination of the main BrowserWindow Renderer while the Electron main process remains alive.

• Ignore clean exits and app shutdown.
• Capture the bounded reason and exit code in existing main-process diagnostics.
• Present a native recovery dialog where Copy Diagnostics remains auxiliary to Relaunch or Exit.
• Keep the report Desktop-only instead of inferring Runtime Host authority.

中文

当 Electron 主进程仍存活、主 BrowserWindow 的 Renderer 意外终止时提供可恢复的诊断入口。

• 忽略正常退出和应用关闭流程。
• 将限长后的退出原因与退出码记录到既有主进程诊断中。
• 通过原生恢复弹窗提供复制诊断信息，同时保留重新启动或退出决策。
• 报告仅归因于 Desktop，不推断 Runtime Host。

Fixes #3490
Refs #3463

Verification

English

• npm --workspace @maka/desktop test — 1152 passed
• npm run build
• npm run typecheck
• npm run lint
• npm run format:check
• npx knip --workspace apps/desktop

Focused tests cover the actual render-process-gone observation boundary, shutdown filtering, rejected window loads, and the Copy Diagnostics → Relaunch decision path.

中文

上述检查均通过；聚焦测试覆盖真实的 render-process-gone 事件边界、关闭流程过滤、窗口加载失败，以及“复制诊断信息后仍可重新启动”的决策路径。

Review focus

English

Please verify that the lifecycle filter reports only unexpected loss of the main Renderer and that the native report remains within the existing Desktop diagnostic authority.

中文

请重点确认生命周期过滤仅报告主 Renderer 的意外终止，并且原生报告仍遵循既有 Desktop 诊断权限边界。

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and validated the change under human direction. The commit includes the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

Independent review of 94b689b20.

1. Problem. Main process can outlive the main BrowserWindow Renderer. Without a filter, shutdown looks like a crash; without a native path, there is no recovery once the UI is gone.

2. Solution. observeMainRendererProcessGone is a one-shot on webContents. It ignores clean-exit and anything after before-quit aborts the window-creation signal (that abort happens before Electron closes windows, so shutdown-induced killed/crashed does not open the dialog). Unexpected loss shows the existing diagnostic dialog: Relaunch/Exit are the decisions, Copy Diagnostics is the extra button. hostTarget: 'none' so copyDesktopDiagnosticReport never calls resolveActiveRuntimeHost / resolveRuntimeHost (the test fails those resolvers on purpose). Window load failure is a different path: onWindowCreationError logs, no recovery dialog.

3. Occam. Observer is ~19 lines. Dialog reuses showMessageBoxWithDiagnostics. Diagnostic fields reuse the native helper. Quit coordinator now owns initial window creation and rejected loads. Not extra domain.

Approve.