feat(nix): desktop darwin app bundle

[DavSanchez]

What does this PR do?

Noticed the desktop app for Darwin lacked an app bundle when used via Nix so I thought on adding it.

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• (Darwin only) Modify the desktop nix flake output so it creates an app bundle. Contents/MacOS/Hermes is the renamed Electron Mach-O binary (not a wrapper script) so the bundle can be codesigned and notarized; runtime env is delivered via Info.plist LSEnvironment. The hermes-desktop command is a thin wrapper launching it for nix run / CLI use.
• (Darwin only) Install install-stamp.json at Contents/Resources/ so the runtime's process.resourcesPath lookup finds it, and add a desktop-app-layout flake check (nix/checks.nix) covering the bundle layout.

How to Test

On macOS:

1. nix build .#desktop.
2. open result/Applications/Hermes.app

A structural check of the bundle layout (app, Mach-O executable, Resources/app, root-level install stamp) runs on Darwin with:

nix build .#checks.aarch64-darwin.desktop-app-layout

Alternatively (my use case for adding it):

1. Add the desktop flake output to an existing home-manager configuration (in home.packages)
2. Activate this config with home-manager switch
3. See the application icon show up on ~/Applications/Home Manager Apps.
4. Open it by double-click.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.3.1

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[teknium1]

Thanks for addressing the missing macOS app-bundle workflow. The feature premise remains valid: current nix/desktop.nix:153-177 still produces only the flat $out/share/hermes-desktop layout.

Problems

• nix/desktop.nix:164 puts every renderer artifact under Contents/Resources/app. Current main emits install-stamp.json at the renderer root (nix/desktop.nix:134), while the runtime reads process.resourcesPath/install-stamp.json or APP_ROOT/build/install-stamp.json (apps/desktop/electron/main.ts:231-234). A salvage onto current main would put the stamp at Resources/app/install-stamp.json, where neither lookup finds it.
• nix/checks.nix:3-5 limits full checks to Linux, and this PR has no reported checks. The new Darwin bundle layout needs a structural or launch-path verification.

Suggested changes

• Rework the bundle against current nix/desktop.nix (rewritten in 39d09453f) and keep resources consumed through process.resourcesPath at Contents/Resources.
• Add Darwin-oriented output-layout coverage for Applications/Hermes.app, the executable, Resources/app, and the root-level install stamp.

Automated hermes-sweeper review.

[teknium1]

Current main emits install-stamp.json at the renderer root (nix/desktop.nix:134), but the runtime reads only process.resourcesPath/install-stamp.json or APP_ROOT/build/install-stamp.json (apps/desktop/electron/main.ts:231-234). Copying all renderer artifacts here moves it to Resources/app/install-stamp.json, which neither lookup reads after salvage; install that metadata at Contents/Resources separately.