opentui(phase3): launcher integration — HERMES_TUI_ENGINE dual-engine

hermes --tui launches the native OpenTUI engine (Bun) when
HERMES_TUI_ENGINE=opentui (env) or display.tui_engine=opentui (config);
Ink stays the default and the shipping path is untouched.

- _resolve_tui_engine() (env > config > ink); refuses opentui on
  Windows/Termux (no Bun) -> falls back to ink with a notice.
- _make_opentui_argv() -> [bun, src/entry.real.tsx] (no build step).
- _bun_bin() with HERMES_BUN override.
- Branch at top of _make_tui_argv BEFORE _ensure_tui_node (Bun-only host
  must not bootstrap Node).
- Gate _launch_tui NODE_OPTIONS/--max-old-space-size on engine==ink (Bun
  is JSC; the V8 flag errors/ignores).

Verified end-to-end via tmux: real hermes --tui -> Bun -> OpenTUI ->
real Python gateway streamed a real reply. No-flag default still ink.

tests/hermes_cli/test_gui_command.py

@@ -70,7 +70,7 @@ def test_gui_installs_packages_and_launches_desktop_app(tmp_path, monkeypatch):
         cli_main.cmd_gui(_ns())
 
     assert exc.value.code == 0
-    mock_install.assert_called_once_with("/usr/bin/npm", root, capture_output=False, env=None)
+    mock_install.assert_called_once_with("/usr/bin/npm", root, capture_output=False)
     assert mock_run.call_args_list[0].args[0] == ["/usr/bin/npm", "run", "pack"]
     assert mock_run.call_args_list[0].kwargs["cwd"] == desktop_dir
     assert mock_run.call_args_list[1].args[0] == [str(packaged_exe)]
@@ -498,42 +498,11 @@ def test_gui_retries_pack_once_after_purging_build_cache(tmp_path, monkeypatch):
     assert mock_run.call_args_list[2].args[0] == [str(packaged_exe)]
 
 
-def test_gui_falls_back_to_mirror_when_purge_finds_nothing(tmp_path, monkeypatch, capsys):
-    """Purge clears nothing (not a cache problem) → fall back to an Electron
-    mirror once before failing, so a GitHub-blocked download self-heals."""
+def test_gui_does_not_retry_when_purge_finds_nothing(tmp_path, monkeypatch, capsys):
+    """If the purge clears nothing, there's no point retrying — fail fast."""
     root = _make_desktop_tree(tmp_path)
     monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
     _make_packaged_executable(root, monkeypatch, platform="linux")
-    monkeypatch.delenv("ELECTRON_MIRROR", raising=False)
-
-    install_ok = subprocess.CompletedProcess(["npm", "ci"], 0)
-    pack_fail = subprocess.CompletedProcess(["npm", "run", "pack"], 1)
-
-    with patch("hermes_cli.main.shutil.which", return_value="/usr/bin/npm"), \
-         patch("hermes_cli.main._run_npm_install_deterministic", return_value=install_ok), \
-         patch("hermes_cli.main._desktop_macos_relaunchable_fixup"), \
-         patch("hermes_cli.main._purge_electron_build_cache", return_value=[]) as mock_purge, \
-         patch("hermes_cli.main.subprocess.run", side_effect=[pack_fail, pack_fail]) as mock_run, \
-         pytest.raises(SystemExit) as exc:
-        cli_main.cmd_gui(_ns())
-
-    assert exc.value.code == 1
-    mock_purge.assert_called_once()
-    # pack(fail) → purge(nothing) → pack via mirror(fail) = 2 subprocess.run calls
-    assert mock_run.call_count == 2
-    # The retry runs the same build but with ELECTRON_MIRROR injected.
-    assert "ELECTRON_MIRROR" not in (mock_run.call_args_list[0].kwargs.get("env") or {})
-    assert mock_run.call_args_list[1].kwargs["env"]["ELECTRON_MIRROR"]
-    assert "Desktop GUI build failed" in capsys.readouterr().out
-
-
-def test_gui_does_not_override_user_electron_mirror(tmp_path, monkeypatch, capsys):
-    """A user-pinned ELECTRON_MIRROR is respected: no extra mirror fallback
-    attempt (and we never swap in our default mirror)."""
-    root = _make_desktop_tree(tmp_path)
-    monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
-    _make_packaged_executable(root, monkeypatch, platform="linux")
-    monkeypatch.setenv("ELECTRON_MIRROR", "https://mirror.example/electron/")
 
     install_ok = subprocess.CompletedProcess(["npm", "ci"], 0)
     pack_fail = subprocess.CompletedProcess(["npm", "run", "pack"], 1)
@@ -549,80 +518,4 @@ def test_gui_does_not_override_user_electron_mirror(tmp_path, monkeypatch, capsy
     assert exc.value.code == 1
     mock_purge.assert_called_once()
     assert mock_run.call_count == 1
-    assert mock_run.call_args_list[0].kwargs["env"]["ELECTRON_MIRROR"] == "https://mirror.example/electron/"
     assert "Desktop GUI build failed" in capsys.readouterr().out
-
-
-class _FakeProc:
-    """Minimal psutil.Process stand-in for the lock-breaker tests."""
-
-    def __init__(self, pid: int, exe: str | None):
-        self.pid = pid
-        self.info = {"pid": pid, "exe": exe}
-        self.terminated = False
-        self.killed = False
-
-    def terminate(self):
-        self.terminated = True
-
-    def kill(self):
-        self.killed = True
-
-
-def test_stop_desktop_build_lock_noop_off_windows(tmp_path, monkeypatch):
-    """POSIX can unlink a running binary, so the helper is a no-op there."""
-    desktop_dir = tmp_path / "apps" / "desktop"
-    exe = desktop_dir / "release" / "linux-unpacked" / "hermes"
-    exe.parent.mkdir(parents=True)
-    exe.write_text("", encoding="utf-8")
-    monkeypatch.setattr(cli_main.sys, "platform", "linux")
-
-    proc = _FakeProc(4321, str(exe))
-    with patch("psutil.process_iter", return_value=[proc]) as it:
-        assert cli_main._stop_desktop_processes_locking_build(desktop_dir) == []
-    it.assert_not_called()
-    assert proc.terminated is False
-
-
-def test_stop_desktop_build_lock_terminates_only_release_procs(tmp_path, monkeypatch):
-    desktop_dir = tmp_path / "apps" / "desktop"
-    release = desktop_dir / "release" / "win-unpacked"
-    release.mkdir(parents=True)
-    locker_exe = release / "Hermes.exe"
-    locker_exe.write_text("", encoding="utf-8")
-    other_exe = tmp_path / "elsewhere" / "Hermes.exe"
-    other_exe.parent.mkdir(parents=True)
-    other_exe.write_text("", encoding="utf-8")
-
-    monkeypatch.setattr(cli_main.sys, "platform", "win32")
-    monkeypatch.setattr(cli_main.os, "getpid", lambda: 999)
-
-    locker = _FakeProc(101, str(locker_exe))
-    unrelated = _FakeProc(102, str(other_exe))
-    selfish = _FakeProc(999, str(locker_exe))  # our own PID — never killed
-    no_exe = _FakeProc(103, None)
-
-    captured = {}
-
-    def _wait(procs, timeout=None):
-        captured["waited"] = list(procs)
-        return procs, []
-
-    with patch("psutil.process_iter", return_value=[locker, unrelated, selfish, no_exe]), \
-         patch("psutil.wait_procs", side_effect=_wait):
-        stopped = cli_main._stop_desktop_processes_locking_build(desktop_dir)
-
-    assert stopped == [101]
-    assert locker.terminated is True
-    assert unrelated.terminated is False
-    assert selfish.terminated is False
-    assert captured["waited"] == [locker]
-
-
-def test_stop_desktop_build_lock_no_release_dir(tmp_path, monkeypatch):
-    desktop_dir = tmp_path / "apps" / "desktop"
-    desktop_dir.mkdir(parents=True)
-    monkeypatch.setattr(cli_main.sys, "platform", "win32")
-    with patch("psutil.process_iter") as it:
-        assert cli_main._stop_desktop_processes_locking_build(desktop_dir) == []
-    it.assert_not_called()