fix(desktop): guard git-based self-update against hung processes

[foras910521-lab]

Summary

• Cap git operations in the Desktop self-update path at 15s via GIT_OPERATION_TIMEOUT_MS
• On timeout, kill the spawned child with SIGTERM and resolve with timedOut=true so the UI can recover
• Clear the pending timeout when the child exits/errors to avoid double-firing
• Add tests/test_desktop_update_safety.py to guard the timeout hook and kill path

Why

The Desktop self-update path shells out to git. If git hangs (slow remote, network glitch, host refusing connection) the spawned child runs forever and the update UI never recovers. This is an infinite-spinner failure mode observed when the network is unreliable.

Diff scope

• apps/desktop/electron/main.cjs: runGit() now wraps spawn in a timeout that fires SIGTERM and resolves with timedOut=true
• tests/test_desktop_update_safety.py: pins the timeout hook + kill path

Out of scope

The companion fix that makes the Python backend reachable in the packaged app (dist/** added to build.asarUnpack, guarded by tests/test_desktop_packaging.py) is split out into #39093 to keep this change small and reviewable.

Test plan

• python -m pytest tests/test_desktop_update_safety.py -q passes locally
• tests/test_desktop_packaging.py (covered by fix(desktop): unpack dist/** so Python backend can serve the web bundle #39093) is intentionally not modified in this PR

[YoussefEttamimi]

Reviewed and this looks good to merge.

What I checked:

• runGit() now uses a settled guard to avoid double resolution.
• The timeout path appends an actionable stderr message, attempts child.kill('SIGTERM'), and resolves with { code: null, timedOut: true }.
• The normal error and exit paths clear the timer, so successful/failed git operations should not leave a pending timeout behind.
• Existing callers already treat code !== 0 as failure, so timeout should recover the update UI instead of hanging forever.

Checks I ran/verified during review:

• python -m pytest tests/test_desktop_update_safety.py -q — passed
• node --check apps/desktop/electron/main.cjs — passed

Non-blocking suggestions for a follow-up:

• Validate HERMES_DESKTOP_GIT_TIMEOUT_MS so invalid/zero/negative values fall back to a sane default instead of producing an immediate or unexpected timeout.
• Consider replacing the textual Python guard with a JS behavioral test that mocks spawn and verifies SIGTERM, timedOut: true, timer cleanup, and no double resolution.

No blocking issues found.