#8739 test(desktop): pin the journal snapshot before recovery, keep start going when the journal cannot load, and run tmux in the canary E2E

Summary

Review follow-ups from #8737 and #8733.

• The journal-snapshot test now fails when the snapshot is taken after recovery.
  • Recovery hands its deliveries off without waiting for them, so the journal still held the result when recover() returned. A snapshot taken after recovery therefore stayed green.
  • The test now makes recovery return only once Sim has the result and the journal no longer holds it.
• A journal load that throws no longer stops the executor from starting.
  • The pending-results snapshot catches a rejected journal.load(), logs it, and counts the journal as holding none.
  • Without that, start() would never reach recovery or the inbox.
• The electron@latest canary job now installs tmux. Before, its terminal-cancel tmux scenarios skipped silently.
• Not changed:
  • forget dropping the call index entry: a ledger test already pins it. It has no other observable effect: after forget, the record file is gone, so a late advance finds nothing and does nothing.
  • A plain-shell user command in the cookie test: sign-out closes every plain shell by design. A user's plain-shell command is checked against Stop, and the user's tmux pane against every path.

Type of Change

• Test coverage

Testing

• Desktop executor tests: 88/88.
• Red checks: each of these fails the service tests in 3 of 3 runs:
  • moving the snapshot after recover();
  • removing the snapshot;
  • removing the .catch.
• EC2 gate: green.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)