Phase 004: remove the desktop shell, website tooling, and bundled hermes CLI

- Drop all desktop/Electron branches, scripts, and UI (title bar, pets,
  desktop bridge); LAN endpoint kind is now web/custom only
- Replace the bundled hermes CLI with user-side installation: add
  GET /api/hermes/cli-status plus a HermesMissingView onboarding guide
- Remove the version-management UI (snapshots handled by git) and prune
  dead website/mcu/claude scripts and lockfile entries

docs/chat-chain-changes/2026-10-16-phase004-remove-desktop.md

@@ -0,0 +1,37 @@
+---
+date: 2026-10-16
+pr: pending
+feature: Phase 004 - remove the desktop shell and bundled hermes CLI
+impact: No chat-chain behavior change; the bridge manager only loses an unused HERMES_DESKTOP helper, and gateway autostart no longer branches on desktop mode.
+---
+
+# Phase 004 — Remove the desktop shell
+
+Phase: `docs/phases/phase_004.md`
+
+## What Changed
+
+Phase 004 removes Electron packaging, the version-management UI, and the
+bundled hermes CLI. Two chat-chain-adjacent files were touched:
+
+- `packages/server/src/services/hermes/agent-bridge/manager.ts` — deleted the
+  unused `isDesktopRuntime()` helper (it read `HERMES_DESKTOP`; no call site
+  remained after earlier cleanup). Gateway IPC readiness, spawn, and kill paths
+  are unchanged.
+- `packages/server/src/services/hermes/gateway-autostart.ts` — removed the
+  Windows desktop orphan-recovery branch (`shouldRecoverWindowsDesktopGatewayOrphans`
+  / `recoverWindowsDesktopGatewayOrphans`) and its `HERMES_DESKTOP` gating.
+  Managed gateway recovery on other platforms keeps its existing behavior.
+
+## Contract Check
+
+`/chat-run` event names, field names, field types, and emission timing are
+unchanged. No run dispatch, session, or usage-recording behavior changed.
+
+## Verification
+
+```bash
+npm run harness:check
+npm run build
+npm run test
+```

docs/openapi.json

@@ -2675,6 +2675,32 @@
         }
       }
     },
+    "/api/hermes/cli-status": {
+      "get": {
+        "tags": [
+          "Health"
+        ],
+        "summary": "Get cli-status",
+        "description": "GET /api/hermes/cli-status",
+        "operationId": "hermesCliStatus",
+        "security": [
+          {
+            "BearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        }
+      }
+    },
     "/api/hermes/config": {
       "get": {
         "tags": [