fix(desktop): allow updater handoff for gateway-only venv locks

[nanami7777777]

Summary

• treat Windows update-lock timeouts as recoverable when the remaining same-install venv holders are only gateway run processes
• add a focused Windows process scanner with WMIC and PowerShell fallbacks to identify same-install holders safely
• add Electron tests for holder detection, gateway-only handoff decisions, and WMIC fallback behavior

Problem

Issue #75334 describes a real dead-end in the Desktop self-update flow on Windows: the desktop preflight waits for the venv shim lock to disappear, but it only kills backends the desktop itself owns. If the remaining lock holder is a same-install hermes gateway run process, Desktop aborts the update even though hermes update already knows how to pause and resume Windows gateways safely.

Fix

After the 15s Desktop-side unlock wait expires, this change inspects the remaining same-install venv holders. If they are all gateway processes, Desktop now hands off to the updater instead of aborting, letting the existing hermes update pause/resume logic finish the job. Non-gateway holders still block the update exactly as before.

Testing

• cd apps/desktop && npx vitest run --project electron electron/update-lock-handoff.test.ts electron/windows-child-options.test.ts
• cd apps/desktop && npx tsc -p tsconfig.electron.json --noEmit

Closes #75334

[teknium1]

Thanks for tracing the updater handoff path; current main does have the reported initial lock-timeout abort at apps/desktop/electron/main.ts:2815-2819.

Problems

• The new success return after the timeout does not reach the updater. applyUpdates immediately runs scanVenvBlockers at apps/desktop/electron/main.ts:2943 and aborts a blocked scan at :2945-2952. That scanner deliberately treats a process running from venv\\Scripts\\python(w).exe as a holder (hermes_cli/update_cmd.py:2638-2640), which includes the proposed gateway-only case.
• update-lock-handoff.test.ts tests the classifier in isolation but not this subsequent preflight, so the currently unreachable handoff is not covered.

Suggested changes

• Thread one conservative gateway-only classification through both Desktop gates, or make the existing preflight expose a validated classification that permits only the exact gateway-only set. Keep non-gateway and probe-failure paths blocking.
• Add an applyUpdates-path regression test proving gateway-only reaches updater spawn while a serve holder remains blocked.

Automated hermes-sweeper review.

[teknium1]

This only bypasses the first Desktop gate. applyUpdates immediately calls scanVenvBlockers on current main (main.ts:2943), and that scanner treats same-install venv\\Scripts\\pythonw.exe gateways as blockers (hermes_cli/update_cmd.py:2638-2640), so the flow still aborts before spawning the updater. Carry the same validated gateway-only classification through that preflight and cover the full sequence in a regression test.

[nanami7777777]

Good catch. You were right that my first pass only opened the Desktop-side timeout gate, while the subsequent Windows venv-holder preflight in the Python update path would still stop the handoff.

I pushed a follow-up that threads a conservative gateway-only allowance through both stages:

• Desktop now returns an explicit allowGatewayOnlyVenvHolders hint when the remaining same-install holders are all gateway run processes.
• The updater handoff passes that as HERMES_UPDATE_ALLOW_GATEWAY_ONLY_VENV_HOLDERS=1.
• hermes_cli.managed_uv._windows_runtime_holders() only honors that hint if it can re-classify the current holder set as gateway-only; mixed / non-gateway / probe-failure cases still block exactly as before.

I also added regression coverage on both sides:

• Electron: update-lock-handoff.test.ts now covers the updater env hint.
• Python: test_update_venv_health.py covers the holder classification, and test_managed_uv.py proves the explicit gateway-only handoff reaches runtime mutation while ordinary holders still defer.

Validation I ran locally:

• cd apps/desktop && npx vitest run --project electron electron/update-lock-handoff.test.ts electron/windows-child-options.test.ts
• cd apps/desktop && npx tsc -p tsconfig.electron.json --noEmit
• .venv/bin/pytest -q tests/hermes_cli/test_update_venv_health.py tests/hermes_cli/test_managed_uv.py