Allow retrying recoverable desktop startup failures

[bb-slop-cop]

Human comments

What was wrong

A transient failure loading the selected desktop server left a static startup error page after the server recovered. The error page could not invoke the existing server-selection recovery flow. Reproduced in actual Electron on main at f41d564.

What changed

Recoverable remote navigation, Connect authentication, and local attachment failures now offer Try again, which reapplies the selected target through the existing desktop flow. Fatal startup, port-conflict, and process-stop errors have no retry button.

The sandboxed preload sends a fixed, argument-free IPC event. Main accepts it only from a registered application window's main frame displaying the current retryable error. Retry state is consumed synchronously and only one attempt runs at a time. This prevents rapid clicks from initiating overlapping target loads; a real Electron regression observed three loads for ten clicks before the guard.

No automatic reconnection system, server/daemon wire changes, configuration, CLI, or public plugin API changes. No host-daemon protocol-version bump is needed.

How you verified

• Pristine-main regression failed before the production change: missing retry control.
• Actual Electron main, window factory, sandboxed preload and IPC tested with custom target recovery, repeated failed retries, concurrent clicks, and rejection of unrelated/fatal pages. Invalid payload/sender/frame checks are injected into the actual registered main handler.
• Synthetic Connect recovery uses a failed session-mint response followed by success and verifies the real Electron cookie store. Hosted Connect/OAuth and Linux Electron were not exercised.
• Real Electron mouse click opened the isolated workspace. Supplementary web QA ran pnpm start:worktree; browser-only coverage is not counted as Electron IPC coverage.
• Desktop Turbo test/build/typecheck/lint, explicit changed-file oxlint, oxfmt, and git diff --check. Electron smoke uses the existing bounded shutdown cleanup, which may escalate to SIGKILL; graceful shutdown is not claimed.

Fixes #3223

AGENT GENERATED