fix(desktop): correct the preview loopback boundary and pin its boot wiring

apps/desktop/src/main/__tests__/preview-preflight.test.ts

@@ -25,9 +25,11 @@
  */
 
 import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
 import { createServer, type Server } from 'node:http';
 import type { Socket } from 'node:net';
 import { after, describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
 import type { MakaTool, MakaToolContext } from '@maka/runtime/tool-runtime';
 import { parseNavigable } from '../browser/logic.js';
 import {
@@ -160,6 +162,9 @@ describe('preview preflight capability classification', () => {
     assert.equal(capability.status, 'verified');
     assert.match(capability.evidence, /HTTP 404/u);
     assert.match(capability.boundary ?? '', /not that any particular page exists there/u);
+    // A remote Runtime Host's server and the Desktop loopback are different machines.
+    assert.match(capability.boundary ?? '', /on the Desktop machine/u);
+    assert.match(capability.boundary ?? '', /Runtime Host runs remotely/u);
   });
 
   it('never turns a failed connection into an unsupported capability', () => {
@@ -311,6 +316,24 @@ describe('artifact preview offer', () => {
     const named = names.filter((name) => ARTIFACT_PREVIEW_HANDOFF.includes(name));
     assert.deepEqual(named, ['ArtifactPreview']);
   });
+
+  it('is the toolset Desktop boot publishes for the artifact preview offer', () => {
+    // Boot cannot be constructed in a unit test, so pin its wiring from source,
+    // as main-startup-lifetime.test.ts does for other boot contracts. Without
+    // this, boot could stop publishing the preflight and no test would fail.
+    const boot = readFileSync(
+      fileURLToPath(new URL('../../../src/main/runtime-host-boot.ts', import.meta.url)),
+      'utf8',
+    );
+    const offer = boot.indexOf("offerId: 'desktop_artifact_preview'");
+    const next = boot.indexOf('offerId:', offer + 1);
+    assert.ok(offer >= 0 && next > offer, 'boot declares the desktop_artifact_preview offer');
+    assert.match(
+      boot.slice(offer, next),
+      /tools: buildArtifactPreviewOfferTools\(\{\s*preflight: createPreviewPreflightAuthority\(\),/u,
+      'the offer publishes the preflight from the production authority',
+    );
+  });
 });
 
 describe('preview preflight loopback probe', () => {

apps/desktop/src/main/preview-preflight.ts

@@ -250,7 +250,7 @@ export function classifyLoopbackEndpoint(input: {
       status: 'verified',
       evidence: `HEAD / at ${input.origin} answered with HTTP ${probe.status} to the Desktop main process.`,
       boundary:
-        'An answer proves a listener at this origin and nothing more: not that any particular page exists there, not that it loads, and not that the embedded browser shares this loopback namespace.',
+        'An answer proves a listener at this origin on the Desktop machine and nothing more: not that any particular page exists there, not that it loads, and, when the Runtime Host runs remotely, not that the listener is the server the agent started.',
     };
   }
   // The rule this whole tool exists for: a connection outcome can produce