fix: make macOS desktop self-update swap+relaunch fail-fast and recoverable

[OmarB97]

Why

The in-app "Update now" flow on macOS can quit the app and never reinstall/reopen, leaving the user with a dead-end. This is a known failure mode: the bundled swap script did not fail fast when ditto or the destination replace failed, and did not clean up/inspect the swap on failure. A related systemic gap is state.db unavailable: database is locked under concurrent Python writers, which surfaces in the TUI.

What changed

• apps/desktop/electron/main.cjs: replaced the old swap script with a fail-fast, trap-cleanup version that falls back to launching the rebuilt bundle directly if the bundle swap fails, so the user never sees a silent dead quit.
• hermes_state.py: added PRAGMA busy_timeout = 5000 so concurrent writers pause instead of tripping database is locked.

How to review

Review the diff in apps/desktop/electron/main.cjs around applyUpdatesPosixInApp and the single-line change in hermes_state.py.__init__. No behavior changes outside the macOS updater swap path and SQLite open path.

Evidence

Pre-fix symptom: Clicking "Update now" quits /Applications/Hermes.app, no reluanch, no installed bundle on retry.
Post-fix expectation: if the swap to /Applications/Hermes.app fails, the built release/mac-arm64/Hermes.app is opened directly; if it succeeds, /Applications/Hermes.app is replaced and reopened.

Verification

1. hermes update or in-app Update Hermes flow succeeds.
2. If swap fails, Electron logs show [updates] ditto failed or [updates] destination replace failed and the rebuilt .app is opened.
3. Concurrent sessions + gateway + dashboard no longer trigger state.db unavailable: database is locked; TUI Sessions tab no longer hangs.

Risks & gaps

• The busy_timeout is conservative and applies to all state.db connections; if a writer holds a lock for >5s it will still error, but that is far better than immediate failure.
• The fallback opens the rebuilt bundle instead of /Applications/Hermes.app; subsequent launches may still need the manual bundle swap if /Applications is the canonical path.

[github-actions]

🔎 Lint report: desktop-mac-swap-fix vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9736 on HEAD, 9736 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5045 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[OmarB97]

Closing: superseded by fork PR #75 mirroring upstream NousResearch#38446 from branch fix/macos-bootstrap-reseal.