fix(desktop): restore exec bit on node-pty spawn-helper for dev terminals

[OutThisLife]

Summary

The embedded terminal in Hermes Desktop crashes on first use in the dev flow with:

Error occurred in handler for 'hermes:terminal:start': Error: posix_spawnp failed.
    at new UnixTerminal (.../node-pty/lib/unixTerminal.js:92:24)

Root cause: node-pty's published npm tarball ships the POSIX spawn-helper with mode 0644 (no exec bit) — verified against the upstream tarball:

$ npm pack node-pty@1.1.0 && tar tzvf node-pty-1.1.0.tgz | grep spawn-helper
-rw-r--r--  package/prebuilds/darwin-arm64/spawn-helper
-rw-r--r--  package/prebuilds/darwin-x64/spawn-helper

node-pty posix_spawnps that helper on macOS/Linux, so a non-executable copy fails every terminal spawn. This reproduces from plain Node too, not just Electron.

Why it only bites in dev:

• Packaged builds are fine — stage-native-deps.mjs copies the helper into dist/ and makeExecutable()s it (chmod 755).
• Dev is not — bundle-electron-main.mjs --dev marks node-pty external, so electron . resolves require('node-pty') from the raw node_modules/node-pty, which nothing ever chmods. Every macOS/Linux dev running npm run dev hits this on the first terminal.

Fix

• New DI-testable helper apps/desktop/electron/spawn-helper-perms.ts that scans a node-pty package root (prebuilds/* + build/Release) and restores exec bits on any spawn-helper that's missing them. Best-effort: missing files are skipped; stat/chmod failures are collected and logged, never thrown.
• Wired into main.ts as a memoized guard invoked right before the first hermes:terminal:start spawn. Packaged builds already stage a 0755 copy, so it's a no-op there; Windows (no spawn-helper) short-circuits.

Single-resolver, single home for the policy — no build-step coupling, and it also self-heals any environment where the bit got stripped.

Test plan

• npx vitest run electron/spawn-helper-perms.test.ts — 6 tests, covers exec-bit detection, candidate discovery, selective chmod, missing files, chmod-failure collection, and the Windows no-op.
• npm run typecheck clean.
• npx eslint clean on changed files.
• node scripts/bundle-electron-main.mjs --dev builds.
• E2E: reset spawn-helper to 0644, confirmed require.resolve('node-pty/package.json') resolves the same copy the app uses, the guard restores 0755, and node-pty spawns successfully.

[alt-glitch]

This was generated by AI during triage.

Related: #61389, #62329, and #61395 repair the packaged-build staging path. This PR instead restores permissions in the raw node-pty dev-flow path before terminal spawn, so it has distinct coverage.