The stage-and-swap promotion in hermes_cli/main_desktop.py::_swap_staged_desktop_app
did three bare os.rename calls (live -> .previous, staged -> live, and the rollback).
A real-time file scanner (AV/EDR) that holds a short exclusive handle on the freshly
packed tree turns any of them into a PermissionError (WinError 32 / 5), so the updater
printed "Could not install the rebuilt desktop app into .../release" even though the
identical rename succeeds a second later. Worse: when the lock hit the ROLLBACK
rename, the live app was left stranded under <unpacked>.previous while the log
claimed "live app kept".
Retry only PermissionError, five attempts with 0.5/1/1/1 s backoff, log each retry,
and let the final OSError propagate to the existing "live app kept" warning.
EXDEV/ENOENT-class failures are permanent and are not retried.
Windows cannot be exercised on this host; the probe monkeypatches os.rename to raise
PermissionError twice then succeed (red on base, green after).
Part of #112544 (promotion atom).
bbdb279a68