feat: publish signed desktop CLI artifacts

[graseeel]

Summary

• builds native Verboo CLI archives for macOS arm64, macOS x64, Windows x64, and Linux x64
• publishes a deterministic manifest signed with Minisign after recalculating every archive size and SHA-256
• verifies archive paths, entry types, package metadata, target, version, and desktop integration markers before release upload
• keeps Node.js outside CLI archives so Verboo Desktop owns the runtime independently

Security and ownership

Pull request jobs only upload short-lived Actions artifacts. They contain no GitHub Release upload path and receive no production signing key. The production job runs only in verbeux-ai/code, fails closed without the protected secrets, verifies the signature before trusting manifest JSON, and never overwrites an existing release asset.

The packaging gate also inspects the built dist/cli.mjs artifact and refuses publication if the TodoWrite contract consumed by Verboo Desktop disappears or is reduced to an orphan marker.

Maintainer setup required

This PR intentionally cannot publish production desktop assets until the protected release environment contains:

• VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64
• VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY

The setup, release, rotation, and compromise procedures are documented in docs/desktop-cli-distribution.md.

Verification

• 16 focused distribution tests pass
• focused TypeScript compilation for every new script passes
• actionlint passes for both changed workflows
• CLI release build passes and reports 0.15.5 (Verboo Code)
• a real 82 MB native archive was packaged and smoked with Node 24.19.0
• an ephemeral Minisign key signed and verified a complete four-target fixture end to end
• the desktop integration marker gate was proven red before implementation and green afterward

The repository-wide TypeScript baseline and two existing release-critical imports already fail on upstream main because mirrored modules/assets are absent; this PR does not modify or mask those unrelated failures.