test(desktop): add electron cdp e2e harness

.qwen/e2e-tests/electron-desktop/cdp-renderer-observability.md

@@ -60,8 +60,54 @@ Slice 10: Renderer Asset Loading and CDP Port.
   the npm lifecycle therefore reported a termination error, which was expected
   for this manual smoke.
 
+## Iteration 9 Automated CDP Harness
+
+Slice 14 added `npm run e2e:cdp --workspace=packages/desktop`, implemented in
+`packages/desktop/scripts/e2e-cdp-smoke.mjs`.
+
+The harness launches Electron with:
+
+- `QWEN_DESKTOP_CDP_PORT=<free port>` bound to `127.0.0.1`;
+- a temporary HOME, runtime directory, and Electron userData directory;
+- a temporary Git workspace with one modified file and one untracked file;
+- `QWEN_DESKTOP_E2E_FAKE_ACP=1` so session, prompt, and permission UI can be
+  exercised without external credentials;
+- `QWEN_DESKTOP_TEST_SELECT_DIRECTORY=<workspace>` so the normal preload
+  directory-selection path can be driven without a native dialog.
+
+Additional assertions now covered:
+
+- renderer target is reachable through CDP;
+- first workspace screen has stable DOM landmarks and screenshots;
+- renderer console errors and failed network requests are collected;
+- Open Project registers the temporary Git workspace and shows changed files;
+- New Thread creates a fake ACP session and connects WebSocket chat;
+- sending a prompt shows a command approval request and approval response;
+- settings save updates the visible model summary;
+- terminal drawer runs a harmless project-scoped command and shows output.
+
+Diagnostics on failure now include screenshot PNGs, DOM text, renderer console
+errors, failed network requests, Electron stdout/stderr, and Git status/diff
+under ignored
+`.qwen/e2e-tests/electron-desktop/artifacts/<timestamp>/`.
+
+## Iteration 9 Execution Results
+
+- `npm run typecheck --workspace=packages/desktop` passed.
+- `npm run build --workspace=packages/desktop` passed.
+- `npm run e2e:cdp --workspace=packages/desktop` passed.
+- `npm run typecheck` passed.
+- `npm run build` passed, with existing VS Code companion warnings only.
+- `npm run bundle && npm run package:dir --workspace=packages/desktop &&
+  npm run smoke:package --workspace=packages/desktop` passed.
+- `npm run smoke:package --workspace=packages/desktop -- --launch` passed.
+- Passing run artifacts:
+  `.qwen/e2e-tests/electron-desktop/artifacts/2026-04-25T02-54-48-799Z/`.
+- The passing run reported `consoleErrors: []` and `failedRequests: []`.
+
 ## Remaining Risk
 
-This slice proves the CDP endpoint exists, but it does not yet automate DOM
-text checks, console/network collection, or screenshot validation. Slice 14 must
-connect through Playwright or Chrome DevTools MCP and persist those diagnostics.
+This harness covers renderer/CDP observability and the main P0 workbench paths,
+but it is a development E2E smoke using fake ACP. Final MVP verification still
+needs the remaining review/terminal polish called out in the implementation
+plan.