[4.0.0-beta desktop] release.yml, qa-build.yml, and liquid-dryrun.yml duplicate the CBL-less desktop recipe #261

PROBLEM

Four workflows each contain a near-copy of the desktop PyInstaller recipe:

• .github/workflows/release-4.0.0-beta.yml (public pre-release — this branch)
• .github/workflows/liquid-dryrun.yml (liquid branch)
• .github/workflows/qa-build.yml (QA branch)
• .github/workflows/release.yml (tag v*)

All four:

• inline a spec / pyinstaller --onefile instead of app/build_mac.spec
• skip libcblite fetch + CFFI build
• pip install tray libs ad-hoc
• --add-data "config.json"

Fixing only release-4.0.0-beta.yml means the next liquid dry-run or v4.0.0 tag ships the same broken desktop app again.

release.yml also claims CHANGELOG.md (not present) and uses softprops/action-gh-release@v1 while the beta workflow uses @v2.

Suggested RCA

Each pipeline was copied forward (liquid → QA → beta → tagged release) without extracting a composite action. The CBL packaging work landed in Docker + design docs, not in these copies.

Suggested FIX

Extract one reusable action:

.github/actions/build-desktop/action.yml

inputs: os (macos|windows), version.
steps: fetch CBL, build bindings, pip install -r requirements-desktop.txt, pyinstaller build_*.spec, package dmg/zip.

All four workflows call it:

- uses: ./.github/actions/build-desktop
  with:
    os: macos
    version: ${{ env.RELEASE_VERSION }}

Until that exists, a test that all four files contain the same required strings (fetch_libcblite, build_mac.spec) will stop this drifting again.

Unit tests

# tests/python/test_workflow_desktop_parity.py
from pathlib import Path

WORKFLOWS = [
    ".github/workflows/release-4.0.0-beta.yml",
    ".github/workflows/liquid-dryrun.yml",
    ".github/workflows/qa-build.yml",
    ".github/workflows/release.yml",
]
REQUIRED = ("fetch_libcblite", "build_mac.spec", "build_win.spec", "couchbase-lite-python")

def test_every_desktop_workflow_uses_the_cbl_recipe():
    root = Path(".")
    missing = []
    for wf in WORKFLOWS:
        text = (root / wf).read_text()
        if "pyinstaller" not in text.lower() and "build-macos" not in text:
            continue  # skip if a workflow no longer builds desktop
        for token in REQUIRED:
            if token not in text:
                missing.append((wf, token))
    assert missing == [], f"workflows missing CBL desktop steps: {missing}"

Context: found on branch release-4.0.0-beta while reviewing standalone macOS .app / Windows .exe packaging. Issues in this batch share the title prefix [4.0.0-beta desktop].