[Bug]: Sidebar "update everything" never updates CLI/npm servers (npm check blocked by CORS preflight) #18690

What happens

On desktop nightly 0.0.46-nightly.20261012.3021, the sidebar's "update everything" button (#18053) updates desktop-app servers but never includes a CLI server. The connected server is a launcher-managed t3 __service-launcher systemd service on 0.0.46-nightly.20261012.3010, which advertises serverSelfUpdate: "boot-service". That server's row in Settings → Connections still shows its update icon, and updating from there works.

npm already has the target version (nightly dist-tag = 0.0.46-nightly.20261012.3021), and both versions are on the nightly channel, so the server should be included.

Cause

useUpdateEverything keeps non-desktop-managed servers only after npm confirms the target version:

• apps/web/src/components/sidebar/useUpdateEverything.ts:56-58 filters with useNpmReleasePublished(targetVersion)
• apps/web/src/state/npmRelease.ts:14 checks with Effect's HttpClient.get + FetchHttpClient.layer

Effect's HttpClient adds traceparent and b3 headers to every request by default (HttpClient.TracerPropagationEnabled defaults to true). Those headers make the browser send a CORS preflight, and registry.npmjs.org answers OPTIONS with 404 and no Access-Control-Allow-Origin. The fetch is blocked, the atom fails, AsyncResult.getOrElse(result, () => false) (npmRelease.ts:40) reports "not published", and every npm/CLI server is dropped from the run. This affects the desktop renderer and app.t3.codes alike. The Connections "Update all" and per-row update don't check npm, which is why they still work.

Repro / evidence

Preflight is rejected:

$ curl -sI -X OPTIONS -H 'Origin: https://app.t3.codes' -H 'Access-Control-Request-Method: GET' \
    https://registry.npmjs.org/t3/0.0.46-nightly.20261012.3021
HTTP/2 404          # no access-control-allow-origin

What the effect 4.0.1 the web app ships sends for HttpClient.get(...) with FetchHttpClient.layer:

{"b3":"d25f…-a0cb…-1","traceparent":"00-d25f…-a0cb…-01"}

The same fetch inside the repo's Electron 44 (Chromium), run from an https:// page:

plain GET:          ok 200
with trace headers: FAILED Failed to fetch

Expected

"Update everything" includes boot-service CLI servers once npm has the target version.

Suggested fix

Turn off trace propagation for this cross-origin request in npmReleasePublishedAtom (apps/web/src/state/npmRelease.ts):

}).pipe(
  Effect.provideService(HttpClient.TracerPropagationEnabled, false),
  Effect.provide(FetchHttpClient.layer),
)

With that change no extra headers are sent and the request stays a simple CORS GET (checked with the same probe). A test on the fetch-failure path would also help: right now a failed check looks the same as "not published", which hid this.