core: extract the store and sync engine into a shared crate (M12 step 1)

Android becomes a native Kotlin client over this same code (Scribe note 2730), so
the local store and sync engine stop being modules of the desktop app and become
`thoughtsync-core`, a crate with no UI framework in it at all.

This is a move, not a rewrite, and the measurement is why: every file in local/
and sync/ already carried ZERO Tauri references — 4,980 of 6,372 lines. The
coupling was 473 lines of command shim, which stays behind in the desktop crate
as src/commands/. Kept as git renames so history follows the files.

The desktop imports them under their old names (`use thoughtsync_core::{local,
sync}`) so every call site reads exactly as before. What moved is where they
live, not what they are.

Two things a workspace changes that are easy to miss, both caught before pushing:

[profile.release] now lives at the workspace ROOT. Cargo silently ignores
profiles declared by a non-root member — leaving it in the desktop crate would
have dropped lto/strip/opt-level from every release build with only a warning.

And a workspace shares ONE target dir, so the bundles moved from
desktop/src-tauri/target to target/. Thirteen references across publish-release,
debundle-graphics, verify.sh, package-prebuilt and the workflow now point there.
Pinning target-dir back would have been the smaller diff, but the Android lane
also produces Rust artifacts and they do not belong under desktop/.

Also retires the Tauri Android lane in the same push rather than leaving a path
that is being replaced: gen/android, android.yml and docs/android-dev.md are
gone, the mobile_entry_point attribute with them, and the lib drops to rlib —
staticlib/cdylib existed for Tauri mobile, and the .so Android loads will be
built from the core crate instead. Rule 22, no parallel path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

desktop/packaging/publish-release.sh

@@ -14,10 +14,10 @@
 # for a tag that already exists.
 #
 # The build + de-bundle steps run first; this consumes their output:
-#   desktop/src-tauri/target/release/bundle/appimage/*.AppImage  (de-bundled)
-#   desktop/src-tauri/target/release/bundle/deb/*.deb
-#   desktop/src-tauri/target/release/bundle/arch/*.pkg.tar.*     (prebuilt pacman)
-#   desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+#   target/release/bundle/appimage/*.AppImage  (de-bundled)
+#   target/release/bundle/deb/*.deb
+#   target/release/bundle/arch/*.pkg.tar.*     (prebuilt pacman)
+#   target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
 #
 # Instance-agnostic: server + repo come from the runner's github.* context
 # (Forgejo populates them for compatibility), so nothing is hardcoded to one host.
@@ -44,9 +44,9 @@ AUTH=(-H "Authorization: token $GITHUB_TOKEN")
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-BUNDLE_ROOT="$REPO_ROOT/desktop/src-tauri/target/release/bundle"
+BUNDLE_ROOT="$REPO_ROOT/target/release/bundle"
 # Cross-compiled Windows output lands under the target triple, not the host root.
-WIN_BUNDLE_ROOT="$REPO_ROOT/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
+WIN_BUNDLE_ROOT="$REPO_ROOT/target/x86_64-pc-windows-msvc/release/bundle"
 
 # --- collect the assets to upload -------------------------------------------
 shopt -s nullglob