fix: apply packaged runtime patches dynamically

[huhuanming]

Summary

• Dynamically apply committed root patches to every matching dependency instance in the Electron appDir production tree.
• Verify the complete patch state after application instead of checking package-specific files or markers.
• Remove the package, file, and marker allowlists so future packaged patched dependencies are handled automatically.

Intent & Context

Electron Builder installs production dependencies independently under apps/desktop/app/node_modules. Root patch-package patches therefore do not automatically reach externalized or transitive dependencies shipped from appDir.

The previous implementation detected packaged patched dependencies dynamically, but remediation still copied a hardcoded file list from selected workspace packages and verified hardcoded markers. That left a maintenance gap whenever a new patched dependency or patched file entered the packaged tree.

Design

• Parse every committed patches/*.patch file and derive its package name and version from the patch itself.
• Recursively discover all matching package instances strictly under appDir node_modules, including scoped, nested, and duplicate instances.
• Match each runtime instance to the committed patch version and fail closed on version mismatch.
• Classify each instance using reverse and forward git apply --check:
  • reverse succeeds: already patched, skip idempotently;
  • forward succeeds: apply the complete committed patch directly;
  • neither succeeds: reject partial application or drift.
• Re-run the reverse check after application, then run the existing full-tree audit before packaging continues.
• Keep committed root patches as the only source of truth; workspace node_modules is no longer used as a patch source.

Changes

• Generalize the shared patch discovery and git apply helpers.
• Rewrite apply-runtime-patches.js to dynamically apply complete committed patches to every matching runtime instance.
• Keep audit-packaged-runtime-patches.js as the independent dynamic verification step.
• Remove packaged-runtime-patches.js, verify-runtime-patches.js, and the updater-specific file list.
• Simplify install-app-deps to install, dynamically apply, and dynamically audit.
• Expand focused tests to cover dynamic application, idempotency, scoped/nested packages, duplicate instances, patch states, version mismatch, and appDir-only discovery.

Risk Assessment

• Risk Level: Medium
• Affected Platforms: Desktop (Windows, macOS, Linux)
• Risk Areas: Cross-platform git apply behavior and recursive appDir dependency discovery. The build fails before packaging on any ambiguity, version mismatch, or drift.

Test plan

• Run 10 focused Jest cases for dynamic application, idempotency, state classification, version matching, scoped/nested packages, no upward fallback, and duplicate instances.
• Run full yarn install-app-deps, including Electron native dependency rebuild.
• Restore the real appDir copies of @sentry/browser@8.42.0 and electron-updater@6.8.9 to pristine content, then verify the dynamic script applies both complete patches.
• Verify both real appDir dependencies pass the independent reverse-patch audit.
• Parse all 65 current root patch descriptors and dynamically intersect them with appDir.
• Run targeted Oxlint with zero warnings or errors.
• Run Prettier and git diff --check.
• Run yarn agent:check --profile commit successfully.