Enable unsigned desktop releases and updater checks

[saltacc]

Summary

• fix Windows source launcher Node resolution when Get-Command returns multiple matches
• remove native artifact smoke tests from Linux, Windows, and macOS CI while retaining builds and core quality gates
• publish unsigned Windows x64 NSIS, macOS arm64/x64 DMG+ZIP, and Linux x64 AppImage artifacts from validated tags
• enable packaged GitHub update detection, with in-app updates on Windows/AppImage and manual DMG replacement on unsigned macOS
• validate release manifests, asset sizes, SHA-512 values, and SHA256SUMS before publication
• verify the updater automatically with a lower-version packaged AppImage against each published GitHub release

Unsigned behavior

• Windows may show SmartScreen warnings; updates use the per-user NSIS installer.
• macOS detects a release but opens its exact GitHub release for manual DMG installation because Squirrel.Mac requires signing for in-app updates.
• Linux support is x64 AppImage only and replaces the writable AppImage after user confirmation.
• Checksums protect transfer integrity but do not establish publisher identity.

Validation

• yarn fmt
• yarn lint
• yarn typecheck
• yarn test
• yarn build:desktop
• CI: https://github.com/cafeai/cafe-code/actions/runs/29874799477
• Release plus hosted updater detection: https://github.com/cafeai/cafe-code/actions/runs/29874821233

The disposable validation prerelease and tag were removed after the hosted detection job passed.