What this PR does

Adds release-version tooling to the desktop release flow. The manual workflow asks for a desktop app version, accepts either 0.0.2 or v0.0.2, normalizes that into package version 0.0.2 and release tag v0.0.2, and uses the same version across installer builds, GitHub Release publishing, and the version-sync PR.

The workflow now bumps desktop package versions inside GitHub Actions. For dry_run=true, each build job bumps locally and builds installers without pushing a branch or touching GitHub Releases. For dry_run=false, the workflow requires main, creates release/desktop-vX.Y.Z, commits the bumped versions, builds from that release ref, publishes the Release against that ref, then creates a version-sync PR back to main and enables auto-merge.

This also adds bun run bump-desktop-version <version>, which updates the three desktop release version sources together: package.json, apps/electron/package.json, and packages/shared/package.json. Use --dry-run to preview the changes without writing files.

Why it's needed

The installer version comes from the Electron app package metadata, while the runtime-visible version comes from the shared package metadata. Without explicit tooling, a maintainer could type 0.0.2 in GitHub Actions while the packaged app still reports 0.0.1, or manually bump only one of the package files.

Keeping these versions aligned is also the base contract needed before electron auto-update metadata is enabled later. Automating the bump in the release workflow removes the need for a manual pre-release version PR.

Reviewer Test Plan

How to verify

Run bun run bump-desktop-version --dry-run 0.0.2 and confirm it lists package.json, apps/electron/package.json, and packages/shared/package.json changing from 0.0.1 to 0.0.2 while leaving the working tree unchanged.

Run the Desktop Release workflow from GitHub Actions with version=0.0.2 and dry_run=true from this branch; confirm the prepare job bumps and validates the version, the build jobs start from the selected ref and bump locally before packaging, the dry-run summary uses release tag v0.0.2, and no release branch or GitHub Release is created.

After this PR lands, run the workflow from main with dry_run=false. Confirm it creates release/desktop-vX.Y.Z, publishes the GitHub Release against that release ref, creates chore(release): desktop vX.Y.Z, and enables auto-merge for that version-sync PR.

Evidence (Before & After)

N/A. This is CI/release automation, not a user-visible UI change.

Tested on

Environment (optional)

Local checks on macOS:

• bun run bump-desktop-version --dry-run 0.0.2
• bun run bump-desktop-version --dry-run v0.0.2
• bun run bump-desktop-version --dry-run 0.02 fails as expected because 0.02 is not valid SemVer
• bun run bump-desktop-version 0.0.1
• bun run check-release-version --version 0.0.1
• bun run check-release-version --version 0.0.2 fails as expected while source versions are still 0.0.1
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/desktop-release.yml"); puts "YAML OK"'
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/desktop-release.yml
• git diff --check

Risk & Scope

• Main risk or tradeoff: The first full installer build and auto-merge path still need to run on GitHub-hosted macOS, Windows, and Linux runners. Local validation proves workflow syntax, version checks, bump behavior, and shell structure.
• Not validated / out of scope: Code signing, notarization, Windows signing, and electron auto-update feed behavior are intentionally not enabled here.
• Breaking changes / migration notes: Maintainers no longer need a manual pre-release version bump PR. For real publishing, run the workflow from main with dry_run=false; the workflow will create and auto-merge the version-sync PR.

Linked Issues

N/A