desktop: release-publish pipeline + one-command Linux installer

Phase A of the desktop Release + install path (M10 / tasks 2014, 1998):

- .forgejo/workflows/desktop.yml: tag-gated "Publish release" step +
  contents:write. On a v* tag the build now publishes a Fabled-Git Release
  with the de-bundled AppImage + .deb attached — a stable, versioned fetch
  target (Actions artifacts are ephemeral/test-only). Dormant on dev/main.
- desktop/packaging/publish-release.sh: creates/reuses the Release via the
  Forgejo API using the runner-injected token; idempotent asset replace.
- desktop/packaging/install.sh: curl|sh one-command installer — native .deb
  on Debian/Ubuntu, de-bundled AppImage everywhere else (installed to
  ~/Applications/ThoughtSync.AppImage, matching src/integration.rs so the app
  sees itself integrated). AppImage path needs no sudo.

Plumbing only — no release cut (rule 2); activates on the operator's first
v* tag. In-app self-update (tauri-plugin-updater + signed latest.json) is
Phase B, gated on the operator's signing key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

.forgejo/workflows/desktop.yml

@@ -25,7 +25,10 @@ concurrency:
   cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
 
 permissions:
-  contents: read
+  # write (not read) so the tag build can publish a Release with the bundles
+  # attached (the "Publish release" step). Read is enough for dev/main builds,
+  # but the token scope is per-workflow, so it's set once here.
+  contents: write
 
 jobs:
   build:
@@ -89,3 +92,14 @@ jobs:
             desktop/src-tauri/target/release/bundle/appimage/*.AppImage
             desktop/src-tauri/target/release/bundle/deb/*.deb
           if-no-files-found: warn
+
+      # Tag builds only: publish a real, versioned Fabled-Git Release with the
+      # AppImage + .deb attached — the stable fetch target the install script and
+      # the in-app updater consume (Actions artifacts above are ephemeral/test).
+      # Cutting the tag is the operator's action (rule 2); this only publishes a
+      # Release for a tag that already exists. Dormant on dev/main pushes.
+      - name: Publish release
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: bash desktop/packaging/publish-release.sh