feat: land tested IPC error hardening, auth hydration retry, and sidecar health monitoring

[simonhagger]

Summary

• What changed:
  • Added typed envelope guards (isSuccess, isFailure), unwrap helpers, and schema-based validateResponseEnvelope to shared contracts with unit coverage.
  • Hardened renderer auth session hydration with bounded retry (3 attempts, exponential backoff) for retryable bridge failures and thrown bridge errors, while preserving existing semantics: non-retryable typed failures hydrate immediately and thrown errors still reject after the final attempt. Adds initializationError signal, reset(), and an injectable AUTH_BRIDGE_PROVIDER token using Angular inject() style.
  • Introduced PythonSidecarHealthMonitor in desktop-main: structural probe/stop decoupling from PythonSidecar, cooldown-guarded automatic restart after consecutive health-check failures, dev-build-only enablement, idempotent dispose wired into window-all-closed.
• Why this change is needed:
  • Land the parked "improvements" batch from earlier working-tree experiments in a tested, convention-compliant form (the originals had no tests, compile errors, private-API access, and scoping bugs).
  • Improve resilience of auth hydration and sidecar lifecycle without changing existing consumer contracts.
• Risk level:
  • Medium (touches auth session hydration path and desktop-main runtime lifecycle; both covered by new unit tests and full local gate run)

Change Groups

• Contracts:
  • Envelope guards/unwrap/validation helpers + error-envelope.spec.ts coverage.
• Renderer Auth:
  • AuthSessionStateService retry/backoff/error-surfacing + TestBed-based spec with fake timers.
• Desktop Runtime:
  • New python-sidecar-health.ts monitor + spec; minimal main.ts wiring (module-scoped instance, non-packaged start, dispose on close).
• Excluded from the original parked batch:
  • error-wrappers.ts (did not compile; duplicated validated-handler factory responsibilities from BL-018/BL-032) — dropped.
  • runtime-migration.ts (dead code, zero imports) — dropped by decision.

Validation

• pnpm nx run contracts:test
• pnpm nx run renderer:test
• pnpm nx run desktop-main:test
• pnpm lint
• pnpm typecheck
• pnpm unit-test
• pnpm integration-test
• pnpm runtime:smoke
• prettier --check . / nx format:check

Engineering Checklist

• Conventional Commit title used
• Unit/integration tests added or updated
• A11y impact reviewed (N/A — no UI changes)
• I18n impact reviewed (N/A — no user-facing strings added)
• IPC contract changes documented (additive helper exports only; wire format unchanged)
• ADR added/updated for architecture-level decisions (N/A — no architecture decision)

Security (Required For Sensitive Changes)

• Security review completed
• Threat model updated or N/A explained
• Confirmed no secrets/sensitive data present in committed files

Security Notes

• Threat model link/update:
  • N/A for this increment.
• N/A rationale:
  • No new trust boundaries or privileged capabilities; auth hydration retries stay within the existing renderer→preload→main envelope flow and never widen renderer authority.
  • Sidecar monitor operates only on the existing loopback-bound sidecar lifecycle and is disabled in packaged builds.
  • Retry classification reuses the established retryable flag from typed error envelopes; fail-closed behavior preserved.