fix(desktop): remove build-time secrets and add download verification

[jdmanring]

Summary

Desktop security and packaging fixes:

• C-07: Remove OAuth secrets from esbuild --define (security: secrets were baked into binary)
• C-06: Add SHA256 checksum verification to lint.js downloads
• C-08: Remove placeholder zed-extension package

Files Changed

• packages/desktop/scripts/electron-build-main.ts
• packages/desktop/scripts/electron-dev.ts
• packages/desktop/scripts/build/win32.ts
• packages/desktop/apps/electron/scripts/build-win.ps1
• scripts/lint.js

Type of Change

• Security fix
• Bug fix
• New feature
• Breaking change

Security

Removes SLACK_OAUTH_CLIENT_SECRET, MICROSOFT_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_CLIENT_SECRET from build-time defines. Users now provide credentials via runtime environment variables.

Testing

• Build succeeds
• OAuth flow tested with runtime env vars