fix: harden packaged desktop reopen attach recovery

[anthhub]

What

Fix the packaged macOS desktop reopen path so test builds do not cross-attach to stale launchd sessions and hidden resident instances restore their window correctly.

Why

Packaged test builds could reopen into an old hidden Electron session or attach to stale launchd metadata from another build with the same app version. That could surface as Finder reporting that Nexu was not responding even though controller/openclaw were still alive.

How

• persist a packaged runtimeIdentityPath alongside the existing launchd recovery metadata and treat it as part of build identity during attach
• refuse packaged cross-attach when the runtime identity path changes, even if appVersion is unchanged
• explicitly focus the macOS app before focusing the main window
• route activate through the resident-entry restore path so hidden packaged windows are restored consistently
• add recovery-policy and main-entry regression tests for the new behavior

Affected areas

• Desktop app (Electron shell)
• Controller (backend / API)
• Web dashboard (React UI)
• OpenClaw runtime
• Skills
• Shared schemas / packages
• Build / CI / Tooling

Checklist

• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes
• pnpm generate-types run (if API routes/schemas changed)
• No credentials or tokens in code or logs
• No any types introduced (use unknown with narrowing)

Notes for reviewers

• This is the stop-the-bleeding fix from the packaged reopen investigation.
• The higher-level lifecycle unification is still a follow-up; this PR only hardens the current packaged path.
• I built an unsigned arm64 desktop package locally after the code changes.
• Manual packaged-app verification is still requested after review: close-to-background, reopen from Finder or open, and same-version test build replacement.

[sentry]

Codecov Report

❌ Patch coverage is 64.28571% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
apps/desktop/main/services/launchd-bootstrap.ts	53.33%	7 Missing ⚠️
apps/desktop/main/index.ts	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 805af07582

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".