perf(electron): bound lightweight readiness polling (1/8)

[backryun]

Part of #10321 (stage 1).

What changed

• probe the lightweight auth-exempt /api/health/ping endpoint for Electron startup and restart readiness
• bound each fetch attempt so a stalled response cannot defeat the overall readiness deadline
• require a successful HTTP response instead of accepting arbitrary non-5xx responses
• extract the polling helper into a package-safe module with focused regression tests

Impact

Electron startup avoids invoking the full monitoring-health aggregation path and no longer hangs indefinitely when a readiness fetch stalls. Remote-server changes, port changes, restarts, initial startup, and background recovery now share the same readiness contract.

Validation

• node --import tsx/esm --test tests/unit/electron-server-readiness.test.ts tests/unit/electron-main.test.ts tests/unit/electron-packaging.test.ts (41 passed)
• npm run test:vitest (357 passed)
• npm run check:file-size (pass)
• node --check electron/main.js
• node --check electron/lib/serverReadiness.js

The full npm run test:unit sweep was stopped after the repository existing web-cookie external-network tests remained pending; no failure from the changed Electron files was observed. The current base npm run lint is also red in unrelated files (@omniroute/opencode-plugin/src/index.ts and tests/unit/cli-env-inline-comment-10100.test.ts).

[diegosouzapw]

Thanks for this — clean Stage 1 implementation of #10321. A few things stood out in review:

• Consolidating all 5 readiness call sites in electron/main.js onto a single getServerReadinessUrl() / waitForServer() helper is a nice de-dup — previously they were split between polling the root URL and /api/monitoring/health inconsistently.
• Extracting waitForServer into electron/lib/serverReadiness.js with injectable fetchFn/nowFn/sleepFn is exactly what makes the new tests (tests/unit/electron-server-readiness.test.ts) deterministic — good call, and I especially like that tests/unit/electron-main.test.ts now imports the real implementation instead of the old hand-duplicated inline copy that used to drift from the shipped code.
• Per-attempt bounding via AbortController while still respecting the overall deadline is correctly implemented, including the edge case where the outer timeout is nearly exhausted.
• All CI checks are green, including both fast-path unit suites and Vitest.

No mandatory changes from my side — this looks merge-ready as-is. One small heads-up for sequencing: Stage 3/Stage 4 in the same tracking issue also touch electron/main.js around these call sites, so it'd help to land the stages roughly in order to minimize rebase friction, but that's an operational note, not something to change in this PR.

[diegosouzapw]

Validated in local merge-train .claude/worktrees/merge-train-20260816-000002-suite.log on devbox-vm-06-dev002 @ 8be62df65f61cc4cf29cdc3e6bc38173ffafa4e3 (FAST gates green: static + changed tests + vitest; daily full-suite run still required). Merged under the batch merge-train protocol (merge-gates §7). ⚠️ base-red inherited: #10523 (ServiceSupervisor order-dependent test, not touched by this batch).