Track PyPI's release rather than the newest tag

Built from v2026.8.18 against the CLI on PyPI, the app never starts: it
resolves the CLI, launches the backend, and then fails its readiness probe
with 401 Unauthorized. The two have to agree on the dashboard session-token
handshake -- the app scrapes window.__HERMES_SESSION_TOKEN__ out of the served
HTML, and web_server.py falls back to a random token when it cannot agree, so
every probe after that is rejected. A month separated the two: the tag was
2026-08-18, hermes-agent 0.19.0 on PyPI was 2026-07-20.

Upstream never meets this because their installer builds the app from the same
checkout it installs the CLI from. Pinning the CLI forward to the app's commit
is not open to us either -- Hermes refuses a non-editable install from a git
checkout and tells you to use `uv sync` instead. So the app is pinned back
instead, to the tag PyPI's current release was cut from.

Verified on a worker: the desktop reaches "Hermes backend is ready" and maps
its window, where the newer build stopped at the 401 every time.

pkgbuilds/hermes-desktop/PKGBUILD

@@ -5,12 +5,20 @@
 # so there is no vendor binary to repackage. Their electron-builder config does
 # carry a Linux target, though, and it works; this builds it.
 #
+# The version tracks PyPI rather than the newest tag. The app and the Hermes
+# CLI have to agree on the dashboard session-token handshake, and a newer app
+# against an older CLI fails its readiness probe with a 401 and never starts.
+# Upstream never hits this because their installer builds the app from the same
+# checkout it installs the CLI from -- and refuses a non-editable source
+# install, so the CLI cannot simply be pinned to the app's commit instead.
+# v2026.7.20 is the tag behind hermes-agent 0.19.0 on PyPI; both move together.
+#
 # The app is only a shell: it runs `hermes serve` against a Hermes CLI it does
 # not ship, and clones its own copy with the upstream install script when it
 # finds none. /usr/bin/hermes-desktop heads that off. See hermes-desktop.sh.
 
 pkgname=hermes-desktop
-pkgver=2026.8.18
+pkgver=2026.7.20
 pkgrel=1
 pkgdesc='Native desktop shell for Hermes Agent'
 arch=('x86_64')
@@ -65,14 +73,14 @@ options=('!strip' '!debug')
 # before falling back to `git rev-parse`. That fallback is wrong here: makepkg
 # builds inside this repository, so git ascends out of srcdir and stamps the
 # app with an omarchy-pkgs commit that means nothing upstream.
-_commit=e624e9fde561e1add9388384012b295fde669ade
+_commit=3ef6bbd201263d354fd83ec55b3c306ded2eb72a
 
 _srcdir="hermes-agent-${pkgver}"
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
         'hermes-desktop.sh'
         'hermes-desktop.desktop'
         'hermes-desktop.png')
-sha256sums=('1e3d39d3638ec15fa9d31af262568a953e9272090deb1c50c44cd401175f5b80'
+sha256sums=('285f3fc134ff466a90065e1517801a68993733b807158ee8f32aa01613786990'
             'e7c0e1fd343e9b013de4575fbefdd4f03b3b62fb5c2c2dd3c508f4a26b6608ea'
             '3ef685bfcf366776b025d26c37d32854d8d4aa2023b2bd07c8e08b001ef1e8c4'
             'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52')