feat(desktop): content-hash build stamp, --build-only / --force-build flags

[ethernet8023]

What does this PR do?

Adds a content-hash based build stamp to hermes desktop so unchanged source trees skip the expensive npm install + npm run build step. Uses pathspec for .gitignore-aware file matching instead of a hardcoded skip-list, and introduces --build-only and --force-build CLI flags. Wires --build-only into hermes update so the desktop app is rebuilt (only if needed) as part of the update flow.

Related Issue

Fixes #

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• hermes_cli/main.py — Added _compute_desktop_content_hash() using SHA-256 over the apps/desktop/ source tree (plus root package.json / package-lock.json), with .gitignore filtering via pathspec. Added stamp read/write logic (desktop-build-stamp.json) that compares the current hash to the stored one. Added --build-only flag (build without launching) and --force-build flag (rebuild even when stamp matches). Wired hermes update to call hermes desktop --build-only.
• pyproject.toml — Added pathspec dependency.
• tests/hermes_cli/test_gui_command.py — 16/16 tests covering hash computation, stamp matching, --build-only, --force-build, and the hermes update integration.
• uv.lock — Lockfile update from adding pathspec.
• website/docs/user-guide/desktop.md — Minor doc update for new flags.

How to Test

1. hermes desktop — launches normally; second run skips build (stamp matches).
2. hermes desktop --force-build — forces a rebuild even if the stamp matches.
3. hermes desktop --build-only — builds without launching the app.
4. hermes update — rebuilds desktop only if source tree changed.
5. pytest tests/hermes_cli/test_gui_command.py -q — 16/16 passing.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: NixOS / Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[github-actions]

🔎 Lint report: ethie/desktop-linux-install vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9682 on HEAD, 9681 on base (🆕 +1)

🆕 New issues (1):

Rule	Count
unresolved-import	1

First entries

hermes_cli/main.py:6920: [unresolved-import] unresolved-import: Cannot resolve imported module `pathspec`

✅ Fixed issues: none

Unchanged: 5015 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[teknium1]

Approved. Content-hash build stamp is the right call — consistent with how the npm-install marker already compares lockfiles by content (not mtime) precisely because git checkouts touch mtimes.

Verified:

• Current with main, MERGEABLE.
• 16/16 tests pass with pathspec present.
• E2E against a real tree: gitignore pruning excludes node_modules/dist/logs, source edits flip the hash, ignored-file edits don't, stamp round-trips, and _desktop_build_needed is correct on missing-artifact / stale / clean-match.

Minor nits we may tidy on merge (non-blocking): loosen pathspec==1.1.1 to a range to match repo style, and a double-space typo in 'from pathspec import PathSpec'. Thanks for the clean PR and tests.