What this PR does

Adds a manually triggered desktop release workflow that builds OpenWork installers for macOS, Windows, and Linux, uploads the generated installers as GitHub Actions artifacts, and can publish them to GitHub Releases when dry run mode is disabled.

The workflow now takes a desktop app version input, normalizes 0.0.2 or v0.0.2 into package version 0.0.2 and release tag v0.0.2, then fails before building if the source versions do not match the requested release version.

Why it's needed

OpenWork already has local Electron packaging commands, but there was no GitHub Actions path for producing cross-platform desktop installers or attaching them to the Release tab. This workflow gives maintainers a safe dry-run path first, then an explicit publish path for draft or public releases.

Keeping the app package version and Release tag aligned is also the base contract needed before wiring electron auto-update metadata later.

Reviewer Test Plan

How to verify

Run the Desktop Release workflow from GitHub Actions with a semver version that matches the source package versions. With the current source, use 0.0.1 or v0.0.1 and keep dry_run=true; confirm the version validation job passes, the macOS, Windows, and Linux build jobs complete, the Dry Run Summary lists generated assets, and no GitHub Release is created or updated.

To test a future 0.0.2 release, first update package.json, apps/electron/package.json, and packages/shared/package.json to 0.0.2; otherwise the workflow should fail before building. For release publishing, rerun with dry_run=false and draft=true, then confirm the draft release uses tag v0.0.2 and contains the uploaded installer assets.

Evidence (Before & After)

N/A. This is CI release automation, not a user-visible UI change.

Tested on

Environment (optional)

Local checks on macOS:

• bun run check-release-version --version 0.0.1
• bun run check-release-version --version v0.0.1
• bun run check-release-version --version 0.0.2 fails as expected while source versions are still 0.0.1
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/desktop-release.yml"); puts "YAML OK"'
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/desktop-release.yml
• git diff --check

Risk & Scope

• Main risk or tradeoff: The first real installer build still needs to happen on GitHub-hosted macOS, Windows, and Linux runners because local validation only proves workflow syntax, version checks, and shell structure.
• Not validated / out of scope: Code signing, notarization, Windows signing, and electron auto-update feed behavior are intentionally not enabled by this PR.
• Breaking changes / migration notes: None.

Linked Issues

N/A