bug(desktop): WorkHub controller owner registration breaks the main architecture gate #5357

What happened

The renderer architecture gate fails on current main after #5214 registered useWorkHubController with owner symbol WorkHubRoot. The only existing controller call is inside its private child WorkHubContents, so even unrelated pull requests now fail before their affected suites run.

src/renderer/features/workhub/controller/use-workhub-controller.ts#useWorkHubController:
controller must be called inside WorkHubRoot

How to reproduce

At 3dcf5a125447ad210649f2e3414512aa79813c0a, install root dependencies and run:

node apps/desktop/scripts/check-renderer-architecture.mjs --base HEAD --strict-base

Expected: the registered production owner satisfies the existing gate. Actual: the command exits 1 with the error above. The same failure blocks #5354 in CI run 34993142765.

Environment

• Source: 3dcf5a125447ad210649f2e3414512aa79813c0a
• Reproduced locally on macOS / Node v26.4.0 and in Linux CI
• Surface: Desktop renderer architecture / CI

Logs, screenshots, or additional context

WorkHubRoot currently installs the highlight provider, then WorkHubContents reads its selectWork callback and owns the controller. Lifting the highlight state into a local hook lets WorkHubRoot own both that state and the controller, while continuing to provide the same context around its existing contents. This can satisfy the registered owner without changing the architecture policy or exposing the controller.

Automated report by OpenAI Codex on behalf of the contributor. The unchanged source failure has been reproduced; an isolated repair is being validated.