Harden desktop release token permissions

[wasimysaid]

Summary

• keep the macOS, Linux, and Windows build matrix on the workflow-level read-only token
• pass signed bundles through short-lived Actions artifacts to one publisher job
• consolidate versioned release and updater-channel writes into the sole contents: write job
• preserve Tauri updater metadata and make draft-release retries idempotent
• add regression tests for the release permission boundary

Security impact

The build matrix no longer receives a write-capable GITHUB_TOKEN. Only the minimal publisher job can create releases or replace updater metadata.

Validation

• python3 -m pytest -q tests/security: 171 passed
• PyYAML workflow AST parsing and permission assertions passed
• pre-commit checks passed
• zizmor reported no medium or high findings
• full draft release on the fork passed macOS signing/notarization, Linux packaging, Windows Azure Trusted Signing, artifact handoff, and publication:

[gemini-code-assist]

Code Review

This pull request introduces permission-boundary tests for the desktop release workflow to ensure secure handling of repository write permissions and release credentials. The review feedback suggests specifying encoding='utf-8' when reading the workflow file to prevent platform-dependent encoding failures.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.