fix(security): resolve CodeQL file-system race in ensureOnboardingComplete

Replace existsSync + readFileSync pattern with direct readFileSync
wrapped in try/catch for ENOENT. Eliminates the TOCTOU race condition
flagged by CodeQL (js/file-system-race).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/desktop/src/main/terminal/cli-integration-handler.ts

@@ -910,11 +910,17 @@ function ensureOnboardingComplete(configDir: string): void {
     );
     const claudeJsonPath = path.join(expandedDir, '.claude.json');
 
-    if (!fs.existsSync(claudeJsonPath)) {
-      return; // No .claude.json yet — Claude Code will create it during auth
+    // Read directly instead of existsSync + readFileSync to avoid TOCTOU race (CodeQL js/file-system-race)
+    let content: string;
+    try {
+      content = fs.readFileSync(claudeJsonPath, 'utf-8');
+    } catch (readErr) {
+      if ((readErr as NodeJS.ErrnoException).code === 'ENOENT') {
+        return; // No .claude.json yet — Claude Code will create it during auth
+      }
+      throw readErr;
     }
 
-    const content = fs.readFileSync(claudeJsonPath, 'utf-8');
     const config = JSON.parse(content);
 
     if (typeof config !== 'object' || config === null || Array.isArray(config)) {