fix(desktop): preserve profile for popped-out sessions

[goempire72]

Summary

• pass the owning session profile through Desktop pop-out window actions
• encode the profile in secondary window URLs before the hash route
• seed secondary-window gateway boot from the URL profile so route resume targets the right backend
• add regression coverage for profile-aware secondary window URLs and renderer bridge forwarding

Test plan

• node apps/desktop/electron/session-windows.test.cjs
• npm --workspace apps/desktop exec -- vitest run --environment jsdom src/store/windows.test.ts src/store/profile.test.ts src/app/session/hooks/use-route-resume.test.tsx
• npm --workspace apps/desktop run typecheck
• npm --workspace apps/desktop run build

Notes

This fixes blank/loading secondary windows in multi-profile Desktop setups where opening a session by ID alone can connect the new renderer to the wrong profile/backend.

[alt-glitch]

This was generated by AI during triage.

Related: this is part of the cross-profile Desktop session-resume cluster with #48473 (earliest open, registry-key mechanism), #49619 (route/profile-hint), and #59608 (?profile= URL hint). This PR combines the registry-key (${profile}:${sessionId}) and ?profile= URL-hint approaches. Not a duplicate of any single one — flagging the cluster so a maintainer can pick the canonical implementation.

[teknium1]

Thanks for isolating a real multi-profile Desktop failure. Current main still omits profile ownership from the active secondary-window path: apps/desktop/electron/session-windows.ts:45-55 constructs URLs without a profile hint, apps/desktop/electron/main.ts:7359-7366 forwards only watch, and boot calls desktop.getConnection() before session refresh completes (apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts:434-479).

Problems

• The submitted Electron changes target main.cjs and session-windows.cjs, which are absent on current main after 39d09453f95e8aefc0c97e5d9b30ff341cae9ed8; the active implementation is TypeScript.
• The spectator path remains unhinted: apps/desktop/src/app/chat/composer/status-stack/index.tsx:107 passes only { watch: true }, and ComposerStatusItem has no profile (apps/desktop/src/store/composer-status.ts:16-32).

Suggested changes

• Port the profile URL/IPC/boot changes to the active TypeScript paths and preserve fallback resolution for stale URLs.
• Cover every secondary-window opener, including spectator windows, through one ownership-resolution strategy.
• Add a current regression proving the first secondary-window connection uses the URL profile hint before route resume.

This is an automated hermes-sweeper review.