fix(runtime): harden v0.20 desktop and browser lifecycle

[pai-scaffolde]

Summary

• reject Windows desktop parent PID reuse by validating the parent process start epoch
• isolate Chrome/CDP integration tests from ambient browser sessions and fixed debug ports
• resolve npm audit advisories while preserving npm 10/11 lockfile determinism and Linux libc selectors

Verification

• npm run check
• clean npm ci with npm 10.9.8 and npm 11.17.0 under the repository default .npmrc
• root, web, and ui-tui audits: 0 vulnerabilities under both npm versions
• 11 passed watchdog/CDP containment tests
• Chrome integration: 6 passed, 1 intentional skip
• independent final review: pass

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8414575b1b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve legacy pid-only watchdog launches

On Windows, a backend launched by a desktop build from before this change still sets HERMES_DESKTOP_PARENT_PID but has no HERMES_DESKTOP_PARENT_START_EPOCH; this branch returns True before checking current_parent, so the watchdog exits on its first tick even while Electron is still the actual parent. That breaks mixed-version installs where the Hermes runtime updates before the Electron shell, killing the local serve/dashboard backend after a few seconds; please treat a missing start epoch as the legacy pid-only mode, or gate the stricter check to launchers known to send it.

Useful? React with 👍 / 👎.