refactor(build): share product recipes across distributions

Build TUI, web, desktop UI and runnable agent products from explicit
prepared inputs. Keep dependency preparation separate from distribution
packaging, with PM and native builds sharing uv environment construction.

Docker copies compiled frontend products instead of build dependencies.
Nix retains uv2nix environments and consumes shared assembly through store
references. Native desktop and Termux use the same launcher and frontend
contracts. Preserve the independent PM runtime and source imports from
arbitrary working directories.

Keep failed frontend builds from replacing the previous product, reject
source/output overlap, and bound dependency-process output draining.
Include hermes_wisdom in the Nix wheel: real CLI smoke tests exposed its
missing package declaration on the base revision too.

Verified focused Python and JavaScript suites, Docker build/runtime checks,
Nix desktop and CLI/ACP checks, standalone TUI and packaged Electron PTY,
and real full-Chromium interaction. Native signed installers, Android device
installation and the full repository suite remain CI verification.

nix/checks.nix

@@ -991,17 +991,12 @@ json.dump(sorted(leaf_paths(DEFAULT_CONFIG)), sys.stdout, indent=2)
           echo "ok" > $out/result
         '';
 
-        # Verify every pyproject.toml [project.scripts] entry has a wrapped binary
+        # Exercise every declared command and the environment delivered by
+        # makeWrapper, plus the shared assembler's store-reference contract.
         entry-points-sync = pkgs.runCommand "hermes-entry-points-sync" { } ''
-          set -e
-          echo "=== Checking entry points match pyproject.toml [project.scripts] ==="
-          for bin in hermes hermes-agent hermes-acp; do
-            test -x ${hermes-agent}/bin/$bin || (echo "FAIL: $bin binary missing from Nix package"; exit 1)
-            echo "PASS: $bin present"
-          done
-
+          ${hermes-agent.python}/bin/python3 ${./tests/agent-references.py} \
+            ${hermes-agent} ${../pyproject.toml} ${hermes-agent.agentInputsFile}
           mkdir -p $out
-          echo "ok" > $out/result
         '';
 
         # Verify CLI subcommands are accessible