feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/notifications.ts

@@ -0,0 +1,45 @@
+/**
+ * desktop/src/notifications.ts — B2: batch notification diff across sessions.
+ *
+ * Given the previous per-session snapshots and the latest poll, compute which
+ * sessions warrant a native notification (delegating each decision to
+ * notify-policy's shouldNotify) and the NEW snapshot map to carry forward.
+ *
+ * Pure: never mutates `prev`. The returned `next` map is rebuilt only from the
+ * current snapshots, so sessions that ended (absent this round) naturally drop
+ * out and won't re-fire on their next appearance.
+ */
+
+import { shouldNotify, type NotifyOptions } from './notify-policy.js'
+import type { NotifyDecision, SessionStatusSnapshot } from './types.js'
+
+/** Result of diffing a poll: what to fire now + the state to remember. */
+export interface NotificationsResult {
+  readonly decisions: readonly NotifyDecision[]
+  /** Fresh snapshot map (sessionId → snapshot) for the next round. Handed off as
+   *  ReadonlyMap so callers can't mutate the carried-forward state (immutability
+   *  is a CRITICAL project rule); the concrete Map is still assignable. */
+  readonly next: ReadonlyMap<string, SessionStatusSnapshot>
+}
+
+/**
+ * Diff the latest snapshots against the previous round. Collect only the
+ * notifying decisions, and build a new snapshot map keyed by sessionId. The
+ * input `prev` map is treated as read-only and left untouched.
+ */
+export function computeNotifications(
+  prev: ReadonlyMap<string, SessionStatusSnapshot>,
+  snapshots: readonly SessionStatusSnapshot[],
+  opts: NotifyOptions,
+): NotificationsResult {
+  const decisions: NotifyDecision[] = []
+  const next = new Map<string, SessionStatusSnapshot>()
+
+  for (const snapshot of snapshots) {
+    const decision = shouldNotify(prev.get(snapshot.sessionId), snapshot, opts)
+    if (decision.notify) decisions.push(decision)
+    next.set(snapshot.sessionId, snapshot)
+  }
+
+  return { decisions, next }
+}