fix(desktop): preserve active profile gateway isolation

[konsisumer]

What does this PR do?

Prevents a transient profile mismatch from routing a request to the primary gateway. When the active profile does not have its own secondary socket, the registry now reports no active gateway, allowing callers to take their existing unavailable/fallback path instead of silently sending work to another profile.

Related Issue

Refs #67097

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• apps/desktop/src/store/gateway.ts: return null rather than the primary gateway when the active non-primary profile has no registered secondary socket.
• apps/desktop/src/store/gateway.test.ts: cover a primary-profile re-home while the previous profile remains active.

How to Test

1. From apps/desktop, run npm exec -- vitest run src/store/gateway.test.ts --project ui.
2. In the Desktop app, activate a non-primary profile, then re-home the primary backend; confirm calls scoped to the previous profile do not use the new primary socket.
3. Local source-level verification passed on macOS (darwin-arm64). This worktree lacks the Desktop Node dependencies, so tsc and Vitest could not run here; the required Python suite instead stopped at two unrelated ACP approval failures before completion.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS (darwin-arm64)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A — no skill added.

Screenshots / Logs

N/A — routing-only change.

[alt-glitch]

This was generated by AI during triage.

Related to #67097: this focused patch fixes its first root cause, the activeGateway() primary-fallback route. The report's separate secondary-lifecycle, spawn-environment, and boot-state causes remain outside this PR.

[konsisumer]

Thanks for the clarification. Addressed in this push:

• Desktop: multi-profile message routing sends messages to wrong profile's gateway #67097 relationship: rebased the focused activeGateway() repair onto current main and resolved its one gateway-store conflict without incorporating secondary-lifecycle, spawn-environment, or boot-state work.
• Profile isolation: retained the current HMR-stable registry implementation while preserving the non-primary missing-secondary fallback to null, covered by the targeted regression test.

Addressing maintainer feedback

Related: #67097 (multi-cause Desktop profile-routing report). This update addresses only its activeGateway() primary-fallback cause; the other reported causes remain outside this PR.

Verification: pytest tests/ -q -x --timeout=60 passed. The focused Desktop Vitest command could not run because this checkout lacks vitest.

[konsisumer]

Superseded by merged main commit 4539895 (fix(desktop): never resolve a missing named gateway scope to the primary), which implements this PR's activeGateway() null fallback and adds the related eviction invariant.