feat(desktop): manual-download update check and OSS release manifest

Adds an unsigned, manual-download update flow. The main process fetches the OSS
updates/releases.json manifest (DSH_UPDATE_URL overrides), compares the latest
version, and on startup and hourly prompts to open the per-platform installer
URL; a preload bridge exposes the same check to the SPA's About "check for
updates" button, which renders the version, notes, and a download link.
scripts/generate-release-json.mjs builds the manifest from the packaged
.dmg/.exe. Windows nsis packaging is configured.

Co-Authored-By: Claude <noreply@anthropic.com>

apps/desktop/package.json

@@ -14,6 +14,7 @@
   "scripts": {
     "build": "tsc -b tsconfig.json",
     "build:harness": "node scripts/build-harness.mjs",
+    "generate-release-json": "node scripts/generate-release-json.mjs",
     "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run",
     "pack": "electron-builder"