fix(ci): give the OS and termux lanes everything pnpm installs

- macOS/Windows OS-specific tests had no pnpm: the runner image ships Node
  and npm, which the old source-build, TUI-install and update-finish tests
  used. setup-pm now installs pnpm (and with it PM's Node) as the Linux
  lane already does.
- Prebuilt TUI checks (termux-verify) ran tests-js after installing only
  ui-tui and tests-js. The desktop-builder fixtures build with
  apps/desktop's own vite and node-pty, which npm's whole-workspace install
  happened to provide; select apps/desktop too.
- test_desktop_build_git_windows still called build_prepared_desktop with
  the old npm= keyword.

.github/workflows/termux-verify.yml

@@ -86,8 +86,10 @@ jobs:
           # tests-js generates real icons; the wrapper needs core Pillow/resvg.
           extras: '[]'
           cache-node: false
+      # tests-js builds desktop fixtures with apps/desktop's own toolchain (vite,
+      # node-pty): pnpm installs only the selected workspaces, so select it too.
       - name: Install the locked JS workspace
-        run: pnpm install --frozen-lockfile --filter "{./ui-tui}..." --filter "{./tests-js}..."
+        run: pnpm install --frozen-lockfile --filter "{./ui-tui}..." --filter "{./tests-js}..." --filter "{./apps/desktop}..."
       - name: Check and bundle the TUI
         run: |
           pnpm --dir tests-js run check

.github/workflows/tests-os.yml

@@ -122,7 +122,9 @@ jobs:
           # Installer stage tests inherit setup-pm's HERMES_RUNTIME_DIR. Prepare
           # the verified Git pin once, before per-file parallelism; otherwise
           # each isolated PowerShell stage races to download/extract the archive.
-          packages: ${{ matrix.marker == 'windows' && 'git,ripgrep' || 'ripgrep' }}
+          # pnpm (and with it PM's Node): tests that drive the real
+          # scripts/build/node-deps.mjs and source builds need it on PATH.
+          packages: ${{ matrix.marker == 'windows' && 'git,ripgrep,pnpm' || 'ripgrep,pnpm' }}
           # keychain: the vault-key tests run against the host's real Keychain / Credential Manager.
           extras: '["all", "telegram", "anthropic", "mistral", "fal", "modal", "daytona", "parallel-web", "keychain"]'
           test-environment: 'true'

tests/hermes_cli/test_desktop_build_git_windows.py

@@ -30,7 +30,7 @@ def test_packaged_desktop_build_restores_pm_git_for_stamp_and_pack(
     monkeypatch.setattr(pm, "ensure", lambda *names, base_env, **_: SimpleNamespace(env=installed_git(*names, base_env=base_env)))
     monkeypatch.setattr(main_desktop.subprocess, "run", run)
     monkeypatch.setattr(main_desktop, "_promote_staged_desktop_app", lambda *_args: desktop / "Hermes.exe")
-    main_desktop.build_prepared_desktop(desktop, source_mode=False, npm="C:\\node\\npm.cmd", env=original)
+    main_desktop.build_prepared_desktop(desktop, source_mode=False, pnpm="C:\\pm\\pnpm.exe", env=original)
 
     assert [command[2] for command, _ in calls] == ["build", "builder"]
     assert all(env["PATH"].startswith("C:\\pm-pinned-git\\cmd;") for _, env in calls)