Linux desktop notifications no longer freeze the main process (salvage #109623)

[kshitijk4poor]

Linux desktop notifications no longer freeze the main process when the notification daemon stalls; they go over D-Bus asynchronously and fail with a bounded false instead.

Salvage of #109623 by @BearHuddleston (both commits cherry-picked with authorship preserved; clean apply on current main) plus four follow-ups from review.

Why

Electron's Notification on Linux calls libnotify synchronously. A daemon that is slow to activate, hung, or restarting blocks the main thread for the duration (observed while working on Bot Screen, #108914). Windows and macOS are unaffected and keep the Electron path.

Changes

Contributor commits (@BearHuddleston):

• apps/desktop/electron/notification-linux.ts (new): freedesktop org.freedesktop.Notifications transport over the session bus using the pure-JS dbus-native@0.15.2. Own Hello, GetNameOwner → StartServiceByName fallback → GetCapabilities → Notify with the same payload shape libnotify sends (default/View + indexed actions, desktop-entry, suppress-sound, no expiry). 5 s per-call timeout with AbortController, 10 s cooldown after a failure, NameOwnerChanged fencing so a restarted daemon's reused IDs never fire the old notification's callbacks, sender fencing on ActionInvoked/NotificationClosed.
• notification-ipc.ts: picks the Linux transport on linux, otherwise unchanged Electron Notification; peer renderers now share the in-flight delivery promise for the same dedupe key.
• notification-registry.ts: releaseOnClose option (Linux only) so a daemon-dismissed notification is released instead of held for the 10 min TTL.

Follow-ups (ours):

• refactor: drop fences that cannot execute (finished after an aborted invoke, connection !== state alongside the generation check, if (finished) inside a deleted map entry); a malformed Notify id gets its own error.
• fix: a benign daemon swap mid-call no longer arms the 10 s global cooldown; Linux has no fallback, so that window dropped every notification exactly when the new daemon was healthy. Failures are classified by generation (owner still current → daemon's fault → cooldown; owner replaced since → none), because on a real bus a call to the vanished unique name comes back as NameHasNoOwner, not as the transport's own fence error. The fixture now answers stale unique names that way, and the race test asserts the next notification reaches the new owner immediately.
• test: registerNativeNotifications takes an injectable platform. The only vitest lane runs on ubuntu, and the ipc test had mocked the Linux module, so the Electron branch that Windows/macOS run had zero CI coverage; the Linux tests lose their skipIf. 8 tests now run on every host (was 5 + 3 skipped on macOS).
• fix: dispose() closes the bus socket from the existing will-quit teardown in main.ts, matching the file's keep-alive socket policy.

Dependency: dbus-native@0.15.2 (one runtime dep, xml2js; no native code, no dynamic requires). Lockfile delta is that closure plus sax flipping dev→prod. Bundled into dist/electron-main.mjs by the existing esbuild script; nothing needs to be external.

Verification

Check	Result
tsc -p tsconfig.electron.json, eslint on touched files	clean
vitest notification-{linux,ipc,registry}.test.ts on macOS host	8/8 (contributor head: 5 pass, 3 skipped)
Mutation: Linux transport not selected / releaseOnClose off / delivery timeout removed / cooldown exemption removed / dispose no-op / Notification.isSupported false	each turns the binding test red
Real-wire Linux E2E on the final branch (Docker ubuntu:24.04: dbus-daemon --session + stub org.freedesktop.Notifications, esbuild-bundled transport)	healthy delivery ~7 ms with the libnotify payload shape; click and action round-trip; stalled Notify/GetCapabilities → false at 5.0 s with the event loop alive (53 heartbeats during the stall) and the next call cooled down; absent service and dead bus → false in <10 ms; daemon killed and replaced while GetCapabilities is in flight → false at 0.9 s, next notification delivered 12 ms later (no cooldown)
main-boot-smoke.sh (main.ts touched)	boots
esbuild bundle	dbus-native inlined; only Node builtins remain required

Non-Linux behaviour traced unchanged: linux is undefined, so the isSupported gate, dedupe key, new Notification(options), registry retain and show() order are as before; the renderer discards the notify() result (void window.hermesDesktop?.notify(...)).

Fork CI never ran on #109623 (action_required), so the above is the first execution evidence for this change.

Closes #109623