Docs-Sync #441: the Electron pin is quoted in prose that no guard test covers #456

Source PR: #441 (Bump electron from 43.7.6 to 44.4.5 in /src/nodepilot-desktop, still open).

Affected doc surfaces: src/nodepilot-desktop/README.md, deploy/desktop/Build-DesktopInstaller.ps1 (script header prose), src/nodepilot-desktop/package.json (//types-node note).

The desktop Electron version is written out as a literal string in five places. package-contract.test.ts pins three of them (package.json, the lockfile root entry, and node_modules/electron); the remaining two are prose and drift unnoticed. One of them already has.

• src/nodepilot-desktop/README.md:54 — "Electron is pinned exactly ("electron": "43.7.6")". Correct against main today, and wrong the moment Bump electron from 43.7.6 to 44.4.5 in /src/nodepilot-desktop #441 merges. Not auto-applied: not yet true on main — main still pins 43.7.6, and Bump electron from 43.7.6 to 44.4.5 in /src/nodepilot-desktop #441 is open, so editing now would get ahead of the code.
• deploy/desktop/Build-DesktopInstaller.ps1:10 — the .DESCRIPTION block says the installer stages "the packaged Electron 43.4.1 shell". main pins 43.7.6, so this is already stale, independently of Bump electron from 43.7.6 to 44.4.5 in /src/nodepilot-desktop #441. Not auto-applied: outside the documentation surfaces this sweep edits (it is a build script, not a doc), and whether these version strings should be maintained by hand at all is a human call.
• src/nodepilot-desktop/package.json:29 — the //types-node note reads "Electron 43.7.6 bundles Node 24.x". True today; goes stale with Bump electron from 43.7.6 to 44.4.5 in /src/nodepilot-desktop #441, and the Node major behind Electron 44 needs checking rather than a find-and-replace of the number. Not auto-applied: not yet true on main, and the claim about the embedded Node release needs verification, not a number swap.
• Worth deciding while the above is open: package-contract.test.ts guards the machine-readable pins but not the three prose copies. Either fold the prose into the guard (as DocumentationCountsTests does for number-bearing doc claims) or derive the number instead of restating it — otherwise the next bump repeats this.

Note for whoever picks up #441: as pushed it changes only package.json and package-lock.json, so desktop runtime dependency contract › pins Electron 43.7.6 consistently in the manifest and lockfile will fail until the test is updated too. Flagged here rather than on the PR because this sweep does not comment on source PRs.

Automated docs-drift finding from the nightly documentation-sync sweep — needs triage.