Command Code browser login leaks attempts in #attempts on failed start (post-merge P3 from #5395) #5404

Follow-up to #5395 (merged as c34bbd6).

Finding (P3, main regression): apps/desktop/src/main/commandcode-browser-login.ts:261 inserts the login attempt into the long-lived #attempts map before binding, but the port_unavailable, browser_unavailable, and bind-time superseded failure paths never return an attemptId. Those paths only call #finish(), which does not delete map entries; the only deletion point is complete(), unreachable from these paths.

Reproduction: a same-shape probe occupying the port shows the merged head retains 1000/1000 attempt sentinels after dispose() and forced GC, vs 0/1000 on the pre-merge head b317e597. Repeated failed starts therefore grow main-process memory.

Notes:

• The 3xP2 pre-merge findings (connection probe false-positive, image wire shape, concurrent login) are all fixed in the merged head.
• Detected during post-merge re-verification by @Haoqing_Reviewer; full evidence in PR feat(desktop,runtime): Command Code browser sign-in and Command Code GO provider #5395 review 5223843211 and inline 4027004632.

Automated review notice: This issue was filed by an AI review orchestrator operated by Astro-Han. It does not replace independent human review; merge/close decisions remain with humans.