channels: the dev channel publishes on dev-rolling, so its tag stops shadowing the branch

The rolling dev release lived on a tag named `dev`, beside the branch
named `dev`. Once a clone had fetched tags, `git push origin dev` failed
with "src refspec dev matches more than one" (Scribe #2184, note #3042),
and every session had to know to spell out refs/heads/dev.

The channel is still `dev` everywhere a person sees it: the app's
setting, `install.sh --channel dev`, the stored pref. Only the release
tag moves, to `dev-rolling`, matching roundtable-android. `stable` has no
branch to collide with and keeps its name.

- packaging/channel-tag.sh is the one channel -> tag mapping CI reads:
  the publish steps in android.yml and desktop.yml, the manifest job,
  fetch-clients.sh and guard-forward.sh. guard-forward exits 2 on an
  unmapped channel instead of fetching an empty URL and passing.
- update.rs and install.sh carry their own copy because neither can run
  it; update.rs gains a test that no channel feed is named like a branch.
- tests/test_channel_tag.py runs the script: no tag is a branch name,
  dev is exactly dev-rolling, an unknown channel fails with no output.
- publish-release.sh titles the release "ThoughtSync dev (rolling)", so
  the tag name does not leak into what people read.

TEMPORARY bridge: desktop apps installed before this have
.../download/dev/latest.json compiled in. The dev manifest job sets
BRIDGE_TAG=dev, and write-manifest.sh writes the same latest.json to
the old `dev` release. Its URLs name dev-rolling assets, so those apps
update once into a build that reads the new tag. The bridge, and the old
release and tag, are removed once installed apps have crossed over.
Until then the push still needs the explicit refspec, as
ci-requirements.md now says.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DwoKYuw3qJmUUYsJeNherB

tests/test_channel_tag.py

@@ -0,0 +1,53 @@
+"""The channel -> release tag mapping — `packaging/channel-tag.sh`.
+
+A channel's release tag must never be spelled like a branch. The dev channel's tag
+was `dev`, which shadowed the `dev` branch: once a clone had fetched tags,
+`git push origin dev` failed as an ambiguous refspec (Scribe #2184).
+
+These run the script itself rather than reading it, so a mapping that is correct
+on the page but broken in execution still fails here.
+"""
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parent.parent / "packaging" / "channel-tag.sh"
+
+# The branches this repo pushes. A tag with either name makes the push ambiguous.
+BRANCHES = {"dev", "main"}
+
+
+def tag(channel: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["sh", str(SCRIPT), channel],
+        capture_output=True, text=True,
+    )
+
+
+@pytest.mark.parametrize("channel", ["dev", "stable"])
+def test_no_channel_tag_is_spelled_like_a_branch(channel: str) -> None:
+    result = tag(channel)
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip() not in BRANCHES
+
+
+def test_the_dev_channel_publishes_on_dev_rolling() -> None:
+    # Pinned exactly, not just "not a branch": update.rs and install.sh carry
+    # their own copy of this value, and a silent rename here would strand them.
+    assert tag("dev").stdout.strip() == "dev-rolling"
+
+
+def test_stable_keeps_its_tag() -> None:
+    assert tag("stable").stdout.strip() == "stable"
+
+
+def test_an_unknown_channel_fails_instead_of_naming_a_tag() -> None:
+    # Every caller captures the output as a URL segment. An empty string on
+    # success would build `.../download//latest.json` and read as "nothing
+    # published" — so an unknown channel must exit non-zero and print nothing.
+    result = tag("nightly")
+    assert result.returncode != 0
+    assert result.stdout == ""