channels: the dev channel publishes on dev-rolling, so its tag stops shadowing the branch

The rolling dev release lived on a tag named `dev`, beside the branch
named `dev`. Once a clone had fetched tags, `git push origin dev` failed
with "src refspec dev matches more than one" (Scribe #2184, note #3042),
and every session had to know to spell out refs/heads/dev.

The channel is still `dev` everywhere a person sees it: the app's
setting, `install.sh --channel dev`, the stored pref. Only the release
tag moves, to `dev-rolling`, matching roundtable-android. `stable` has no
branch to collide with and keeps its name.

- packaging/channel-tag.sh is the one channel -> tag mapping CI reads:
  the publish steps in android.yml and desktop.yml, the manifest job,
  fetch-clients.sh and guard-forward.sh. guard-forward exits 2 on an
  unmapped channel instead of fetching an empty URL and passing.
- update.rs and install.sh carry their own copy because neither can run
  it; update.rs gains a test that no channel feed is named like a branch.
- tests/test_channel_tag.py runs the script: no tag is a branch name,
  dev is exactly dev-rolling, an unknown channel fails with no output.
- publish-release.sh titles the release "ThoughtSync dev (rolling)", so
  the tag name does not leak into what people read.

TEMPORARY bridge: desktop apps installed before this have
.../download/dev/latest.json compiled in. The dev manifest job sets
BRIDGE_TAG=dev, and write-manifest.sh writes the same latest.json to
the old `dev` release. Its URLs name dev-rolling assets, so those apps
update once into a build that reads the new tag. The bridge, and the old
release and tag, are removed once installed apps have crossed over.
Until then the push still needs the explicit refspec, as
ci-requirements.md now says.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DwoKYuw3qJmUUYsJeNherB

desktop/packaging/write-manifest.sh

@@ -161,6 +161,41 @@ printf '{\n  "version_name": "%s",\n  "version_code": "%s"\n}\n' \
   "$DISPLAY_VERSION" "$APP_VERSION" > "$work/thoughtsync-desktop.json"
 replace_asset "$work/thoughtsync-desktop.json" "thoughtsync-desktop.json"
 
+# --- TEMPORARY: the one-shot bridge off a retired channel tag ------------------
+#
+# The dev channel's tag was renamed `dev` -> `dev-rolling`, because a tag named `dev`
+# shadowed the branch and broke `git push origin dev` (Scribe #2184). Desktop apps
+# installed before the rename have `.../download/dev/latest.json` compiled in, so
+# without this they would never be offered another build.
+#
+# BRIDGE_TAG names the old release; the SAME manifest is written there too. Its URLs
+# are absolute and name `dev-rolling` assets, so an old app updates once into a build
+# that reads the new tag, and never reads this one again. Only latest.json goes
+# across: the sidecar is read by CI and the image build, which already follow the
+# new tag.
+#
+# A missing bridge release is logged and skipped, not fatal — by then it has been
+# deleted on purpose. A failed WRITE to one that exists fails the job: a bridge that
+# silently stops is an installed base stranded without a word. Remove this block,
+# the BRIDGE_TAG line in desktop.yml, and the old release and tag together.
+if [ -n "${BRIDGE_TAG:-}" ]; then
+  bridge_release="$(curl -sS "${AUTH[@]}" "$API/releases/tags/$BRIDGE_TAG" || true)"
+  bridge_id="$(printf '%s' "$bridge_release" | grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+' || true)"
+  if [ -z "$bridge_id" ]; then
+    echo "==> No release tagged $BRIDGE_TAG — nothing to bridge (retired?)."
+  else
+    # A subshell, so replace_asset's globals point at the bridge release for this
+    # one call only and the prune below still works on $RELEASE_TAG.
+    (
+      release_id="$bridge_id"
+      RELEASE_TAG="$BRIDGE_TAG"
+      assets="$(curl -sS "${AUTH[@]}" "$API/releases/$release_id/assets")"
+      replace_asset "$work/latest.json" "latest.json"
+    )
+    echo "==> Bridged: $BRIDGE_TAG/latest.json now advertises the same build."
+  fi
+fi
+
 echo "==> Done. $RELEASE_TAG now advertises $DISPLAY_VERSION ($APP_VERSION) for ${#entries[@]} platform(s)."
 
 # --- prune superseded builds from a rolling channel ---------------------------