fix(desktop): publish versioned GitHub releases with signed DMGs

[iamnbutler]

Closes #197. Related: #7.

Desktop publishing previously only uploaded the signed archive and Sparkle feed to R2. Add a GitHub release for each published channel/version, tagged at the manifest source revision with the signed DMG attached. Canary releases are published prereleases, never latest stable. Build-only runs remain unpublished.

Create a draft, verify the uploaded asset digest, then publish it before the Sparkle feed commit point. Retries resume drafts or reuse matching releases/assets, refusing conflicting tags or bytes. Grant the release job contents-write permission and supply its GitHub token to the publishing step. Document publishing, recovery, and GitHub-only backfilling.

Validation

• bun types, bun run ci, git diff --check passed; workflow YAML parsed with Bun.
• Used the new publisher to backfill all ten shipped canaries, 0.0.7–0.0.16, from their original successful publishing-run artifacts. Each original DMG matched its release manifest and the existing public R2 bytes. No rebuilds or feed changes.
• Confirmed all ten releases are published prereleases with DMG assets. Repeated 0.0.16 publication successfully without replacing its asset; downloaded that DMG from GitHub and independently matched SHA-256.
• Peer review caught and corrected GitHub missing-commit HTTP 422 handling; new tags are now checked through the ref endpoint (404).
• No new signed CI build was dispatched; integrated R2/feed sequencing and interrupted-draft recovery were reviewed, not exercised end to end. Version 0.0.17 is build-only and was not published.

Built in Ace

Entirely built in Ace using this channel, its isolated lane, shell tools, and a review subagent. Used the authenticated GitHub CLI through Ace for issue/PR operations and real release backfill/verification. No external editor, terminal, or agent.