Phase 008: close the test and CI loop around the migration

Adds the checks that make the constraints from Phase 001-007 mechanical
instead of tribal knowledge, and clears the legacy brand text that was still
reachable at runtime.

New red-line tests:
  - no-legacy-brand mirrors the harness scan under vitest, and asserts its
    allow-list has not drifted from harness-check.mjs
  - hermes-db-readonly classifies every new DatabaseSync call site by
    following the path it opens, and fails if a state.db handle drops
    readOnly. It also pins the one legitimately writable database.
  - i18n-parity compares the raw zh/en locale objects both ways. The
    existing coverage test merged en into zh at import time, so a key
    missing from zh could never fail there.

harness:check gains the four missing gates from the phase brief - retired
package directories, retired package scripts, a single UI library, and the
required root files. Each was verified to fail by mutating the repo.

The online-update channel had hardcoded upstream URLs. It now reads
HERMES_WEB_UI_VERSION_MANIFEST_URL and friends and degrades with a named
error, because a reimplementation has nowhere to pull releases from.

The remaining legacy strings are deliberate and each carries a reason in the
allow-list: the global-agent relay address and the OpenRouter referer are
load-bearing, the socket role identifier is a wire contract, and the pre-rename
DB filenames would orphan existing deployments if changed. AGENTS.md now says
so explicitly, so a future agent does not "clean them up".

Also removes a dead electron mock alias, an i18n exemption that had stopped
exempting anything, and a teardown race in plugins-view.test.ts where a-spin
animation frames outlived the jsdom environment.

Verified self-contained: with reference_code/ moved aside, harness:check,
build, test and test:e2e all pass, so the directory can now be deleted.

packages/server/src/services/runtime-version-manager.ts

@@ -8,9 +8,12 @@ import { config } from '../config'
 import { getHermesWebUiVersion } from './system-info'
 
 const ACTIVE_VERSION_FILE = 'active-version.json'
-const DEFAULT_REMOTE_MANIFEST_URL = 'https://hermes-studio.ai/versions.json'
-const DEFAULT_DOWNLOAD_BASE_URL = 'https://download.ekkolearnai.com'
-const DEFAULT_GITHUB_REPO = 'EKKOLearnAI/hermes-studio'
+// This fork publishes no release channel, so every remote address is
+// deployment-specific and must be configured explicitly. An empty value
+// disables the matching capability instead of contacting a third party.
+const REMOTE_MANIFEST_DISABLED = 'remote version manifest is not configured (set HERMES_WEB_UI_VERSION_MANIFEST_URL)'
+const DOWNLOAD_BASE_DISABLED = 'download base URL is not configured (set HERMES_WEB_UI_DOWNLOAD_BASE_URL)'
+const DOWNLOAD_REPO_DISABLED = 'download GitHub repo is not configured (set HERMES_WEB_UI_DOWNLOAD_GITHUB_REPO)'
 
 export interface ActiveVersionManifest {
   schema: number
@@ -119,15 +122,18 @@ function activeVersionPath(): string {
 }
 
 function downloadBaseUrl(): string {
-  return (process.env.HERMES_WEB_UI_DOWNLOAD_BASE_URL || DEFAULT_DOWNLOAD_BASE_URL).trim().replace(/\/$/, '')
+  return (process.env.HERMES_WEB_UI_DOWNLOAD_BASE_URL?.trim() || '').replace(/\/$/, '')
 }
 
 function downloadAssetUrl(assetName: string, tag: string, source: VersionDownloadSource): string {
   if (source === 'github') {
-    const repo = process.env.HERMES_WEB_UI_DOWNLOAD_GITHUB_REPO?.trim() || DEFAULT_GITHUB_REPO
+    const repo = process.env.HERMES_WEB_UI_DOWNLOAD_GITHUB_REPO?.trim() || ''
+    if (!repo) throw new Error(DOWNLOAD_REPO_DISABLED)
     return `https://github.com/${repo}/releases/download/${encodeURIComponent(tag)}/${encodeURIComponent(assetName)}`
   }
-  return `${downloadBaseUrl()}/${encodeURIComponent(tag)}/${encodeURIComponent(assetName)}`
+  const base = downloadBaseUrl()
+  if (!base) throw new Error(DOWNLOAD_BASE_DISABLED)
+  return `${base}/${encodeURIComponent(tag)}/${encodeURIComponent(assetName)}`
 }
 
 function readJsonFile<T>(file: string): T | null {
@@ -235,8 +241,13 @@ export function listInstalledWebUiVersions(active = readActiveVersionManifest())
   return installed.sort((left, right) => right.version.localeCompare(left.version, undefined, { numeric: true }))
 }
 
+function remoteManifestUrl(): string {
+  return process.env.HERMES_WEB_UI_VERSION_MANIFEST_URL?.trim() || ''
+}
+
 async function fetchRemoteVersions(): Promise<{ manifest: RemoteVersionManifest | null; error: string }> {
-  const url = process.env.HERMES_WEB_UI_VERSION_MANIFEST_URL?.trim() || DEFAULT_REMOTE_MANIFEST_URL
+  const url = remoteManifestUrl()
+  if (!url) return { manifest: null, error: REMOTE_MANIFEST_DISABLED }
   try {
     const response = await fetch(url, { signal: AbortSignal.timeout(5000) })
     if (!response.ok) return { manifest: null, error: `GET ${url} returned ${response.status}` }
@@ -255,7 +266,7 @@ export async function getRuntimeVersionStatus(): Promise<RuntimeVersionStatus> {
     active,
     platform: runtimePlatformKey(),
     activeVersionPath: activeVersionPath(),
-    remoteManifestUrl: process.env.HERMES_WEB_UI_VERSION_MANIFEST_URL?.trim() || DEFAULT_REMOTE_MANIFEST_URL,
+    remoteManifestUrl: remoteManifestUrl(),
     remoteError: error,
     hermes: {
       activeVersion: active?.hermesRuntimeVersion || '',