fix(desktop): correct the preview loopback boundary and pin its boot wiring

[liugddx]

Summary

Two small follow-ups from the #5254 review (preview capability preflight). Neither changes behaviour.

• Correct the loopback_endpoint boundary copy. It said a verified answer does not prove "that the embedded browser shares this loopback namespace". But the embedded browser runs in the Desktop process, so it does share Desktop's loopback. What a verified answer actually leaves unproven is the remote case: when the Runtime Host runs over SSH (runtime-host-managed-services.ts:54), the listener answering on the Desktop machine need not be the server the agent started. A local service on the same port would also answer. The boundary now says that, and the existing endpoint test asserts it. This matters for feat(harness): verify preview open and page load end to end #5235, which builds on this classification.
• Pin the boot wiring of the preflight. runtime-host-boot.ts publishes the preflight in the desktop_artifact_preview offer via buildArtifactPreviewOfferTools({ preflight: createPreviewPreflightAuthority(), … }), and no test covered that call. Boot can't be constructed in a unit test, so the new test pins the call from source, the same way main-startup-lifetime.test.ts pins other boot contracts.

Refs #5254

Verification

• node --test dist/main/__tests__/preview-preflight.test.js: 28/28 pass (the existing 27 plus the new wiring test).
• Mutation checks, each restored afterwards:
  • Replacing createPreviewPreflightAuthority() in boot fails the new wiring test (27/1).
  • Restoring the old boundary copy in the built output fails the endpoint test (27/1).
• biome lint on both files: clean. apps/desktop/** is outside Biome's formatter scope.
• Built locally on Windows: core, storage, mcp, runtime and runtime-host build, and build:main emits. The remaining tsc errors come only from @maka/ui and @maka/computer-use, which I couldn't build on this host, and none are in the changed files. CI's full typecheck is the authority here.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code wrote both changes and ran the mutation checks; I reviewed them.

Checklist

• Tests cover the change and fail without it: both mutants above fail.
• Lint, format, typecheck and the affected suites pass locally. Lint and the affected suite pass; full typecheck is left to CI, as described.

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

🤖 Generated with Claude Code

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Review of 49b68183 (+24/-1, 2 files). Follow-up to #5254; no runtime behavior changes.

Boundary copy (preview-preflight.ts:253). The new wording is more accurate. The embedded browser runs in the Desktop process, so it does share Desktop's loopback. The real gap is the remote Runtime Host case: a listener answering on the Desktop machine need not be the server the agent started there. The updated endpoint test asserts both new phrases.

Boot wiring test. It reads src/main/runtime-host-boot.ts relative to the compiled test (dist/main/__tests__/ → ../../../src/main/), so the path resolves to apps/desktop/src/main/runtime-host-boot.ts in both a local and a CI checkout. It slices out the desktop_artifact_preview offer and checks that it publishes buildArtifactPreviewOfferTools({ preflight: createPreviewPreflightAuthority(), …. This closes the remaining gap from our #5254 review: if boot stopped calling the helper, nothing failed. The author's mutation checks (swapping the authority, restoring the old copy) show both assertions can fail.

Findings: None at P0-P2. One optional P3: the source-text regex depends on the exact tools: buildArtifactPreviewOfferTools({ preflight: createPreviewPreflightAuthority(), layout. A harmless reformat or argument reorder in boot would fail it with a message about wiring rather than formatting. That matches the existing main-startup-lifetime.test.ts approach, so it is acceptable as is.

Status: CI label and test pass, and the PR is MERGEABLE. No protocol files, so there is no epoch impact.