What this PR does

Adds an explicit Qwen Code runtime source selector to the Desktop Release workflow. Release operators can now choose npm_latest, source_branch, or pinned_package_version; source-branch builds check out QwenLM/qwen-code at the requested ref and set QWEN_CODE_ROOT, npm-latest builds set QWEN_CODE_VERSION=latest, and pinned builds continue to use package.json's qwenCodeRuntime.version unless an exact npm version is entered.

The vendoring script now resolves npm dist-tags through package metadata before downloading the tarball, so QWEN_CODE_VERSION=latest resolves to the current npm latest version instead of trying to download a nonexistent qwen-code-latest.tgz file.

Why it's needed

The release UI previously had an optional qwen_code_version text field, but leaving it empty silently packaged the pinned 0.15.11 runtime. That made it too easy to think a desktop release was using the current Qwen Code runtime when it was actually using the package-pinned fallback. The workflow now makes that choice visible and supports the three intended release modes: current npm latest, a Qwen Code source ref, or the pinned runtime version.

Reviewer Test Plan

How to verify

Open the Desktop Release workflow dispatch form and confirm the new qwen_code_source choice contains npm_latest, source_branch, and pinned_package_version. For source_branch, confirm qwen_code_ref controls the QwenLM/qwen-code checkout. For npm_latest, confirm the build logs show the real npm version resolved from the latest dist-tag.

Evidence (Before & After)

Before: running the old vendoring script with QWEN_CODE_VERSION=latest attempted to download https://registry.npmjs.org/@qwen-code/qwen-code/-/qwen-code-latest.tgz and failed with HTTP 404.

After: QWEN_CODE_VERSION=latest bun run scripts/vendor-qwen-code.ts resolved npm latest to 0.17.1 at test time and vendored @qwen-code/[email protected]; the default pinned path vendored 0.15.11; a fake QWEN_CODE_ROOT source checkout smoke test built and vendored a local dist/cli.js.

Tested on

Environment (optional)

Local macOS shell in /Users/dragon/Documents/openwork; Bun 1.3.8, Node 26.0.0, npm 11.12.1.

Risk & Scope

• Main risk or tradeoff: source_branch builds clone and install Qwen Code source dependencies in every platform job, which is straightforward but slower than prebuilding the runtime once and sharing it across the matrix.
• Not validated / out of scope: a full hosted Desktop Release run with source_branch has not completed yet.
• Breaking changes / migration notes: the old empty qwen_code_version behavior is preserved under pinned_package_version, which remains the default.

Linked Issues

References the desktop release workflow follow-up from #5, #6, and #7.