fix(desktop): build hermes-desktop with corrected Electron 43.6.0 headers hash

Upstream hermes-agent v2026.8.31 pins sha256-f8bSb… for the
artifacts.electronjs.org v43.6.0 headers tarball. The CDN swapped
that artifact, breaking every desktop build with a fixed-output
derivation hash mismatch (specified f8bSb… vs got xDgc5…).

Local copy of upstream nix/desktop.nix with:
- verified hash for electron 43.6.0 (nix store prefetch-file)
- per-version hash map with a loud throw for unknown versions
- icon/desktop-entry paths resolved against the flake input checkout

Remove once upstream ships the corrected hash and the hermes-agent
input is bumped past that release.

profiles/contexts/desktop/default.nix

@@ -4,7 +4,20 @@
   m3taHomeInputs,
   pkgs,
   ...
-}: {
+}: let
+  # WORKAROUND (2026-09-12): hermes-agent v2026.8.31 pins a stale hash for
+  # the Electron 43.6.0 headers artifact (the CDN swapped the file). Build
+  # the desktop app from a local copy of upstream's nix/desktop.nix with
+  # the verified hash. Remove when upstream fixes it and the input is bumped.
+  hermesDesktopFixed = let
+    hermesAgent = m3taHomeInputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  in
+    pkgs.callPackage ./hermes-desktop.nix {
+      inherit hermesAgent;
+      hermesNpmLib = hermesAgent.hermesNpmLib;
+      hermesSrc = m3taHomeInputs.hermes-agent.outPath;
+    };
+in {
   imports = [
     ./wm
     ./apps
@@ -72,7 +85,7 @@
       (element-desktop.override {
         commandLineArgs = "--password-store=gnome-libsecret";
       })
-      m3taHomeInputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.desktop
+      hermesDesktopFixed
       launch-webapp
       file-roller
       gsettings-desktop-schemas