feat(desktop): add fenced hosted-room history and responder controls

[JackHunzicker]

What does this PR do?

Adds capability-gated Desktop controls and recovery fixes for the hosted-room work in NousResearch#98307. This companion targets that feature branch so the review contains only Desktop changes, not the inherited backend implementation.

Changes

• Preserve per-room drafts, original image bytes, exact retry targets, and canonical human/member attribution.
• Read canonical paginated history and shared read state, with bounded refresh of idle caches.
• Expose revision-checked edit/delete/reaction actions, scoped Stop confirmations, and hosted clarification cards only when supported.
• Add room responder-policy controls. Re-resolve the owning authority before mutation, bind authority epoch, retain revision CAS, and verify every canonical policy field on read-back.
• Display thread policy as read-only when the host exposes only room defaults; never silently broaden a thread action into a room mutation.
• Add regression tests and a real-Chromium production-component rendering fixture.

Dependencies

This is a Desktop-only source companion to NousResearch/hermes-agent#98307, not a standalone change against main. Its richer operations require the room-backend companion #4. Integrate and verify that backend contract before treating this client as release-ready. Unsupported operations remain unavailable.

Native Codex PR #105502 separately supplies the native-participant continuity and terminal guarantees; it does not implement the room service. Android Relay #559 is a draft sibling client, not a Desktop prerequisite. No additional scheduler or native runtime is introduced.

Verification

• Windows 11: Desktop TypeScript checks pass.
• Hosted-room policy regression tests cover route-authority changes, epoch changes, incorrect canonical state and differing policy read-back.
• Full Desktop bot-plugin suite on the submitted branch: 1,399 tests passed, zero failures (npx vitest run src/plugins/hermes-bots --maxWorkers=2). This includes the retarget-during-preflight regression in a025d0a308359890fb0a72a750305c467af02e8a.
• Real Chromium rendering of production components verified room/thread policy surfaces in light and dark themes and an isolated policy update/read-back. The room history fixture also exercises drafts, original image bytes, retry isolation and narrow viewports.
• These are local tests and isolated RPC fixtures, not a live-provider, physical-device or deployment acceptance claim.

Checklist

• Conventional commits with developer sign-offs.
• Desktop-only contribution; no backend, dependency or lockfile changes.
• Regression tests added for changed behavior.
• No production deployment, account changes or history migration.
• Hosted CI: this feature-author fork has published no check runs for the submitted head. The local qualification above is not a hosted-CI claim.

The full Python repository suite is not claimed for this Desktop-only change. Existing partial locale fallback is retained.