ci(desktop): workflow de release (C6) sur tag desktop-v*

.gitea/workflows/desktop-release.yml : garde-fou tag==version (packages/desktop), npm ci racine + npm ci desktop (hors workspaces), npm run dist:linux (AppImage+deb), artefacts + attachement des installeurs et de latest-linux.yml (auto-update) à la release Gitea via NPM_TOKEN. Windows/macOS : build manuel sur ces OS (README desktop). N'affecte aucun workflow existant (tag desktop-v* distinct de v* et vscode-v*).

.gitea/workflows/desktop-release.yml

@@ -0,0 +1,78 @@
+# Packaging de l'app de bureau Electron, déclenché UNIQUEMENT par un tag desktop-vX.Y.Z (séparé de
+# la release du daemon qui écoute v*, et du VSIX qui écoute vscode-v*). Linux (AppImage + deb) est
+# automatisé ici ; Windows et macOS se buildent sur ces OS (voir packages/desktop/README.md) et
+# leurs artefacts sont attachés manuellement à la release.
+name: Desktop Release
+
+on:
+  push:
+    tags: ['desktop-v*']
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '22.21.1'
+
+jobs:
+  linux:
+    name: Build Linux (AppImage + deb)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+      # Garde-fou : le tag (sans "desktop-v") doit correspondre à la version du paquet desktop.
+      - name: Verify tag matches desktop version
+        run: |
+          pkg=$(node -p "require('./packages/desktop/package.json').version")
+          tag="${GITHUB_REF_NAME#desktop-v}"
+          if [ "$pkg" != "$tag" ]; then
+            echo "ERREUR: tag '$tag' != version desktop '$pkg'"
+            exit 1
+          fi
+          echo "OK: tag $tag == version $pkg"
+      # Deps racine (build/pack du daemon) puis deps du paquet desktop (hors workspaces racine).
+      - run: npm ci
+      - name: Install desktop deps
+        run: cd packages/desktop && npm ci
+      # Build complet : shell + daemon empaqueté + Node standalone + AppImage/deb (electron-builder).
+      - name: Build installers
+        run: cd packages/desktop && npm run dist:linux
+      # Artefacts du run : canal fiable, indépendant de l'API release.
+      - uses: actions/upload-artifact@v3
+        with:
+          name: desktop-linux
+          path: |
+            packages/desktop/release/*.AppImage
+            packages/desktop/release/*.deb
+            packages/desktop/release/latest-linux.yml
+      # Best-effort : attache les installeurs (+ latest-linux.yml pour l'auto-update) à la release
+      # Gitea du tag (crée la release si absente). Réutilise NPM_TOKEN (même token Gitea).
+      - name: Attach installers to Gitea release
+        continue-on-error: true
+        env:
+          RELEASE_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -z "$RELEASE_TOKEN" ]; then
+            echo "::notice::NPM_TOKEN absent : installeurs disponibles en artefact uniquement."
+            exit 0
+          fi
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          auth="Authorization: token ${RELEASE_TOKEN}"
+          version=$(node -p "require('./packages/desktop/package.json').version")
+          rid=$(curl -fsSL -H "$auth" "${api}/releases/tags/${GITHUB_REF_NAME}" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).id || ''" || true)
+          if [ -z "$rid" ]; then
+            rid=$(curl -fsSL -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"Arboretum Desktop ${version}\"}" \
+              "${api}/releases" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).id || ''")
+          fi
+          for f in packages/desktop/release/*.AppImage packages/desktop/release/*.deb packages/desktop/release/latest-linux.yml; do
+            [ -f "$f" ] || continue
+            name=$(basename "$f")
+            echo "attaching $name"
+            curl -fsSL -X POST -H "$auth" -F "attachment=@${f}" "${api}/releases/${rid}/assets?name=${name}"
+          done
+          echo "Installeurs Linux attachés à la release ${GITHUB_REF_NAME}."