fix: align CLI and Desktop local runtimes

[bheemreddy-samsara]

Summary

CLI commands and Executor Desktop now avoid split-brain local runtimes in both startup orders.

If Desktop is already running, CLI commands can target its authenticated sidecar with --base-url or EXECUTOR_BASE_URL. Credentials embedded in that URL are sent as Basic-auth headers and stripped from display output. If a local endpoint returns 401 Unauthorized, the CLI now explains that credentials are required instead of treating the occupied port as unavailable and starting a second daemon.

If a compatible CLI daemon is already running first, Desktop discovers it from the CLI daemon pointer files and attaches only when Desktop auth is disabled and the daemon serves the shared ~/.executor-global scope. Authenticated, stale, malformed, or different-scope listeners are skipped so Desktop does not attach to an unrelated runtime or bypass its configured auth settings.

Desktop uses ~/.executor-global as its default shared scope so MCPs configured for CLI/agent usage are visible in Desktop too. Desktop settings are also initialized lazily after Electron sets its userData path, preventing Desktop from reading stale settings from Electron's default app-data location and accidentally spawning on the CLI port.

Testing

• bunx vitest run tests/desktop-server-discovery.test.ts tests/daemon-bootstrap.test.ts
• bun run --cwd apps/desktop typecheck
• bun run --cwd apps/cli typecheck
• bun run format:check
• bun run lint
• bunx --bun electron-vite build from apps/desktop
• CSC_IDENTITY_AUTO_DISCOVERY=false bunx electron-builder --mac dir --arm64 --config electron-builder.config.ts from apps/desktop
• Manual packaged Desktop app launch confirmed the app uses the shared ~/.executor-global scope and syncs the MCP sources from ~/.executor-global/executor.jsonc.
• Manual packaged Desktop app launch confirmed unauthenticated /api/scope returns 401 and authenticated /api/scope returns 200 on the Desktop sidecar when it owns port 4789.
• Manual 401 probe with a local server confirmed the CLI reports the auth requirement instead of starting a duplicate daemon.
• Manual authenticated daemon status --base-url http://executor:secret@... probe confirmed Basic auth headers are sent and output hides credentials.
• Manual local discovery probe with a real HTTP server returning the shared scope confirmed Desktop discovery selects the existing runtime when given a verified candidate.

[bheemreddy-samsara]

@RhysSullivan thoughts here ?