fix(desktop): restore sandboxed preload bridge

[NWYLZW]

Summary

• bundle @oneworks/types into the sandboxed Electron preload so packaged Launcher windows receive window.oneworksDesktop
• verify emitted preload bundles contain only sandbox-supported runtime require() calls
• add a regression test, package-preflight coverage, stable module guidance, and the Desktop changelog entry

Changelog

• Changelog path or "Not applicable": changelog/1.0.0-rc.4/desktop.md

Screenshots

Not applicable. This restores an existing Desktop bridge without changing the UI.

Validation

• pnpm -C apps/desktop typecheck
• pnpm -C apps/desktop test:package-preflight (16 files, 172 tests)
• pnpm dprint check
• pnpm exec eslint .
• pnpm -C apps/desktop run package
• pnpm -C apps/desktop smoke:package
• installed macOS Dev app runtime verification of window.oneworksDesktop methods and Launcher IPC

Review Scope

• Risk: medium
• Applicable profiles: Desktop and dual runtime paths (RUNTIME-001, DESKTOP-002)
• Evidence: emitted preload verification, regression tests, full package smoke, and installed-app runtime IPC verification
• Rule exceptions: none

Experience Review

• 已判断是否需要沉淀经验
• 如需要，已运行 $post-task-experience-review
• reviewer PASS / NOT APPLICABLE 后才进入 merge

Policy Conflict Review

• Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ignored		Aug 20, 2026 5:46am

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer `PASS` / `NOT APPLICABLE` 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS or NOT APPLICABLE for the Experience Review Result.
• For workflow, permission, or release-rule documentation changes, also add this checked section to the PR body after an independent read-only conflict review:

## Policy Conflict Review
- [x] Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS