refactor(build): share product recipes across distributions

Build TUI, web, desktop UI and runnable agent products from explicit
prepared inputs. Keep dependency preparation separate from distribution
packaging, with PM and native builds sharing uv environment construction.

Docker copies compiled frontend products instead of build dependencies.
Nix retains uv2nix environments and consumes shared assembly through store
references. Native desktop and Termux use the same launcher and frontend
contracts. Preserve the independent PM runtime and source imports from
arbitrary working directories.

Keep failed frontend builds from replacing the previous product, reject
source/output overlap, and bound dependency-process output draining.
Include hermes_wisdom in the Nix wheel: real CLI smoke tests exposed its
missing package declaration on the base revision too.

Verified focused Python and JavaScript suites, Docker build/runtime checks,
Nix desktop and CLI/ACP checks, standalone TUI and packaged Electron PTY,
and real full-Chromium interaction. Native signed installers, Android device
installation and the full repository suite remain CI verification.

nix/desktop.nix

@@ -70,6 +70,8 @@ let
     dirs = [
       "apps/desktop"
       "apps/shared"
+      "scripts/build/desktop.mjs"
+      "scripts/build/frontend-common.mjs"
     ];
     pname = "hermes-desktop-renderer";
 
@@ -78,44 +80,30 @@ let
     buildPhase = ''
       runHook preBuild
 
-      mkdir -p apps/desktop/build
-      cp ${installStampFile} apps/desktop/build/install-stamp.json
-      cp -r ${generatedIcons}/apps/desktop/public/. apps/desktop/public/
-
       patchShebangs .
 
-      pushd apps/desktop
-        # typecheck :3
-        npm exec -- tsc -b
+      # The native provider runs before compilation. Use the headers for
+      # the exact Electron runtime shipped by this derivation, offline.
+      mkdir -p "$TMPDIR/electron-headers"
+      tar -xzf ${electronHeaders} -C "$TMPDIR/electron-headers" --strip-components=1
+      ${lib.getExe hermesNpmLib.node-gyp} rebuild \
+        --directory=node_modules/node-pty \
+        --build-from-source \
+        --runtime=electron \
+        --target=${electron.version} \
+        --arch=${targetArch} \
+        --nodedir="$TMPDIR/electron-headers" \
+        --disturl="" \
+        --offline
 
-        # build the renderer bundle
-        # vite's emptyOutDir wipes dist/ on every run
-        # so it has to be first
-        npm exec -- vite build
-
-        # build the electron bundle
-        node scripts/bundle-electron-main.mjs
-
-        # Compile node-pty against Electron's actual ABI (the nixpkgs
-        # `electron` we ship). Headers come from a pinned fetchurl input
-        # since the sandbox has no network here, so node-gyp's
-        # normal --disturl download path can't run.
-        mkdir -p "$TMPDIR/electron-headers"
-        tar -xzf ${electronHeaders} -C "$TMPDIR/electron-headers" --strip-components=1
-
-        ${lib.getExe hermesNpmLib.node-gyp} rebuild \
-          --directory=../../node_modules/node-pty \
-          --build-from-source \
-          --runtime=electron \
-          --target=${electron.version} \
-          --nodedir="$TMPDIR/electron-headers" \
-          --disturl="" \
-          --offline
-
-        # Target platform/arch come from stdenv.hostPlatform, not the
-        # build host's own process.platform/arch.
-        node scripts/stage-native-deps.mjs ${targetPlatform} ${targetArch}
-      popd
+      node apps/desktop/scripts/stage-native-deps.mjs \
+        --source "$PWD" --out "$TMPDIR/desktop-native-deps" \
+        --platform ${targetPlatform} --arch ${targetArch}
+      node scripts/build/desktop.mjs \
+        --source "$PWD" --out "$PWD/apps/desktop/dist" \
+        --icons ${generatedIcons} --stamp ${installStampFile} \
+        --native-deps "$TMPDIR/desktop-native-deps" \
+        --platform ${targetPlatform} --typecheck
 
       runHook postBuild
     '';
@@ -144,11 +132,7 @@ let
     installPhase = ''
       runHook preInstall
       mkdir -p $out
-      # vite writes to apps/desktop/dist/ (we cd'd there in buildPhase).
-      # stage-native-deps.mjs stages node-pty into dist/node_modules/node-pty,
-      # so copying dist/ wholesale carries the native dep along with the
-      # esbuild bundle that require()s it. apps/desktop/build was created
-      # before the cd.
+      # The shared product contains renderer, main/preload, and native deps.
       cp -rn apps/desktop/dist $out/
 
       cp ${installStampFile} $out/install-stamp.json