Desktop D3 — ship it: code-sign/notarize, deep-link auth callback, auto-update + a real download #774

Part of epic #754. Desktop work item D3 of 3. Blocked by #773 (D2).
Direction + full plan: docs/migration/desktop-deno-runtime.md.

Goal — "it's shippable"

Turn the working desktop app into something a non-developer can download, install, log into, and keep updated.

Scope

• Code-sign + notarize the macOS build (Windows signing if in scope).
• Add a CI release job (replaces the deleted Tauri CI) that produces the signed artifacts.
• Register the deep-link / custom URL scheme for the auth callback (the native half of D2's login).
• Wire Deno.autoUpdate() with a latest.json manifest; verify rollback on a bad build.

Proof / acceptance

• A signed, notarized build a non-developer can download from Releases, install, open, and log into.
• Update test: the app pulls + applies a newer build; a deliberately-broken build rolls back.

Prev: #773 (D2, secure data/auth). After this, desktop is in users' hands.