Retire the bridge to the old dev channel release

Scribe #3884. The dev channel's release tag moved from `dev` to `dev-rolling`
on 2026-09-10. Since then, the manifest job has also written latest.json to the
old `dev` release, so that desktop apps installed before the move could update
across. The operator has had two desktop installs and is fine reinstalling,
so the bridge goes. The old release and tag are deleted next, through the forge.

- desktop.yml: the BRIDGE_TAG=dev export is removed.
- write-manifest.sh: the TEMPORARY bridge block is removed.
- ci-requirements.md: the "Transitional" paragraph becomes a note that the tag
  is gone, and that an app installed before 2026-09-10 reinstalls with
  install.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/desktop.yml

@@ -517,13 +517,6 @@ jobs:
             main) RELEASE_TAG="$(sh packaging/channel-tag.sh stable)"
                   export RELEASE_NOTES="Stable build from ${GITHUB_SHA}" ;;
             *)    RELEASE_TAG="$(sh packaging/channel-tag.sh dev)"
-                  # TEMPORARY one-shot bridge (Scribe #2184). Desktop apps installed
-                  # before the rename have .../download/dev/latest.json compiled in,
-                  # so the manifest is also written to the old `dev` release; its
-                  # URLs name dev-rolling assets, so those apps update once into a
-                  # build that reads the new tag. Delete this line together with the
-                  # old `dev` release and tag.
-                  export BRIDGE_TAG=dev
                   export RELEASE_NOTES="Development build from ${GITHUB_SHA}" ;;
           esac
           # Assigned bare above so a failing channel-tag.sh fails this step;

ci-requirements.md

@@ -425,14 +425,9 @@ had fetched it, `git push origin dev` failed with
 tag after a branch; `tests/test_channel_tag.py` and the `update.rs` tests fail if
 one is.
 
-**Transitional, from 2026-09-10:** the old `dev` release still exists so desktop
+The old `dev` release and tag were deleted on 2026-10-08 (Scribe #3884), with the
-apps installed from it can update across — the manifest job writes `latest.json`
+bridge that kept writing to them. A desktop app installed before 2026-09-10 reads
-to it too (`BRIDGE_TAG=dev` in `desktop.yml`). Until that release and its tag are
+that tag and gets no further updates; reinstall it with `install.sh`.
-deleted, fully qualify pushes:
-
-```
-git push origin refs/heads/dev:refs/heads/dev
-```
 
 ## Shell scripts have no CI lane
 

desktop/packaging/write-manifest.sh

@@ -161,41 +161,6 @@ printf '{\n  "version_name": "%s",\n  "version_code": "%s"\n}\n' \
   "$DISPLAY_VERSION" "$APP_VERSION" > "$work/inkwell-desktop.json"
 replace_asset "$work/inkwell-desktop.json" "inkwell-desktop.json"
 
-# --- TEMPORARY: the one-shot bridge off a retired channel tag ------------------
-#
-# The dev channel's tag was renamed `dev` -> `dev-rolling`, because a tag named `dev`
-# shadowed the branch and broke `git push origin dev` (Scribe #2184). Desktop apps
-# installed before the rename have `.../download/dev/latest.json` compiled in, so
-# without this they would never be offered another build.
-#
-# BRIDGE_TAG names the old release; the SAME manifest is written there too. Its URLs
-# are absolute and name `dev-rolling` assets, so an old app updates once into a build
-# that reads the new tag, and never reads this one again. Only latest.json goes
-# across: the sidecar is read by CI and the image build, which already follow the
-# new tag.
-#
-# A missing bridge release is logged and skipped, not fatal — by then it has been
-# deleted on purpose. A failed WRITE to one that exists fails the job: a bridge that
-# silently stops is an installed base stranded without a word. Remove this block,
-# the BRIDGE_TAG line in desktop.yml, and the old release and tag together.
-if [ -n "${BRIDGE_TAG:-}" ]; then
-  bridge_release="$(curl -sS "${AUTH[@]}" "$API/releases/tags/$BRIDGE_TAG" || true)"
-  bridge_id="$(printf '%s' "$bridge_release" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+' || true)"
-  if [ -z "$bridge_id" ]; then
-    echo "==> No release tagged $BRIDGE_TAG — nothing to bridge (retired?)."
-  else
-    # A subshell, so replace_asset's globals point at the bridge release for this
-    # one call only and the prune below still works on $RELEASE_TAG.
-    (
-      release_id="$bridge_id"
-      RELEASE_TAG="$BRIDGE_TAG"
-      assets="$(curl -sS "${AUTH[@]}" "$API/releases/$release_id/assets")"
-      replace_asset "$work/latest.json" "latest.json"
-    )
-    echo "==> Bridged: $BRIDGE_TAG/latest.json now advertises the same build."
-  fi
-fi
-
 echo "==> Done. $RELEASE_TAG now advertises $DISPLAY_VERSION ($APP_VERSION) for ${#entries[@]} platform(s)."
 
 # --- prune superseded builds from a rolling channel ---------------------------