fix(desktop): desktop updates reconnect in seconds, not minutes (#12006)

Desktop updates deleted the managed tunnel at shutdown, so remote clients spent about two minutes reconnecting after an 11 second restart. The desktop app now writes a restart marker before it stops its backends for any install, local or remote. The server keeps the tunnel when it finds a fresh marker at shutdown and consumes it. Failed or interrupted installs delete the marker.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>