e2e: harness for full desktop coverage; account and device flows - #29848

Fourth of eight stacked PRs. The release gate (#29845) now covers every screen and every write action in the desktop app. This PR holds the shared harness pieces the coverage flows build on, plus the account and device flows. PRs 5–7 add flows by area; PR 8 fixes the app bugs the gate found.

Summary

• Run-stamped objects and the sweeper. Everything a run creates (subteams, channels, emoji, team repos, messages, devices, paper keys) carries the run id. The sweeper deletes older runs' objects with exact, guarded deletes: never a glob, never outside the e2e team, never the main device or the owner's paper key, and it re-checks each deleted message by id.
• Corpus (fixtures/corpus/): one small file per type the app previews or uploads (png, jpg, gif, heic, mp4, mov, m4a, pdf, txt, zip, an empty file, a large png, a unicode name), regenerated by make-corpus.mts.
• Main-process stubs (helpers/main-process.ts): open/save dialogs, openExternal, notifications, the focused window and the service socket, through the main process's inspector. Every stub is restored by the fixture, including after a worker died.
• Accounts: asSecond / restoreToSmoke, withCleanup (restore first, then delete), and a stored-secret check-or-repair that runs around every flow that signs in as the second account. Rotating the second account's password refuses while a change is pending.
• Secrets: secret-typing goes through the main process into a focused field only, polls by length, and is cleared and unmounted on failure. Those files run with retries: 0 and trace: 'off'. The secret scan checks every artifact for every password value the run held, and the release has a secrets phase.
• Known failures (known-failures.ts): a deterministic app bug gets a strict failing test of the normal user path plus an entry naming its cause. The entry is only a label in the report; the run still fails.
• Census: the provision screens and startup RPCs count, and exclusions carry their reason.
• Flows: signed-out screens, login, recover password, reset and signup to their edges; provision and revoke a device, paper keys, unlock folders.
• App test IDs: a few testIDs added in the app (paper key, global errors, menubar rows, block modal, file rows, download footer, relogin list, profile card).

Decisions for review

• No account creation or deletion, and no reset or signup completion. Those flows stop at their edge and cancel. The manual checklist lists the remaining steps.
• Contact only between the test accounts. No SMS, no reports, no blocks confirmed.
• The release never stops or restarts the main service. Peer accounts run their own services with the file secret store.
• A flaky or skipped test fails the run. Retrying a UI action is never allowed; only setup and read-backs retry, and only on named transient server errors.

Evidence

The full release on the top of this stack (PR 8): see PR 8.
This branch passes yarn lint:all and yarn test:unit.