versioning: each artifact derives from its own files, with the clock picked per value

Step 4 of M314. `desktop/packaging/build-version.sh` was one generator feeding
the desktop bundles AND the Android APK off `GITHUB_RUN_NUMBER`, so a
Kotlin-only commit re-versioned the desktop and a Rust-only commit
re-versioned the phone. Note 3127 §3 cites this repo as its example of that
failure. It is replaced by `packaging/version.sh` — one definition of HOW to
derive, three file sets, and the sets in one place.

Lives at the repo root rather than under desktop/, because it serves three
artifacts now and a shared thing filed under one consumer ends up owned by it.

## Two values, and the clock chosen per value (§2)

  desktop  key      1.0.<minutes since 2020-01-01>   commit time
  desktop  display  2026.08.28.0900                  commit time  (#3181 shows it)
  android  versionName                               commit time
  android  versionCode  <minutes since 2020>         BUILD time
  server   version  2026.08.28.0900                  commit time, no ordering key

Every human-readable version in the repo is now one shape. The two exceptions
are not version names at all — they are bare monotonic integers a comparator
reads and nobody quotes.

The desktop needs a separate key because Tauri parses `latest.json` with the
semver crate and `2026.08.28.0900` fails it twice (four segments, and `08` is a
leading zero). `1.0.` and not `0.0.`: the minor has to clear the installed
`0.2.466` line or every dev user is stranded on "up to date" permanently.

Android's code comes from BUILD time while the desktop's key comes from COMMIT
time, deliberately. Android hard-fails a downgrade with
INSTALL_FAILED_VERSION_DOWNGRADE and leaves a channel you cannot get out of, so
its key must be monotonic by construction; the desktop merely declines to offer
an update, which a guard can catch.

## The bug this found in itself

The shallow-clone guard `exit 1`-ed inside a function called as `$(...)` —
which ends the SUBSHELL, not the script. `display` still failed, but only
because `date` then choked on the empty string. `key` printed the error to
stderr, emitted `1.0.-26297280`, and exited ZERO.

That is precisely the failure the guard exists to prevent: a too-low version on
a green lane, and too-low is the direction you cannot recover from. It resolves
into a global in the parent shell now. The test is parametrized over both
requests, because one path was covered and the other was broken in exactly the
way the covered one was meant to rule out.

## Also

`fetch-depth: 0` on every job that derives — four of them, and only ci.yml's
gate had it. Depth-1 is silently wrong rather than loudly broken (§6.1).

The file sets include each artifact's BUILD RECIPE (its workflow, and
`packaging/`). A workflow file is not shipped, but change a Gradle flag and the
bytes change while the source does not — and once step 6 skips a build whose
version already exists, that serves the OLD artifact on a green run.

The base images are deliberately NOT resolved at derive time: that is an
external lookup, which §7's corollary forbids. `Dockerfile` is already in the
server's set, so pinning `FROM` by digest in step 6 puts the base inside the set
for free.

`build-version.sh` is deleted, its last consumer (the pacman packager) moved
over, and the one finding worth keeping out of its header — why not a `-dev.N`
prerelease — is preserved in the successor.

#3144

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

desktop/packaging/arch/package-prebuilt.sh

@@ -64,7 +64,9 @@ DEPENDS=(webkit2gtk-4.1 gtk3)
 # this?" question unanswerable.
 # `|| true` so a miss falls through to the explicit error below rather than
 # aborting on pipefail with no explanation.
-PKGVER="$(sh "$SCRIPT_DIR/../build-version.sh" || true)"
+# The ORDERING KEY: pacman compares this, and it must match the filename the
+# bundle build produced (write-manifest.sh selects on it).
+PKGVER="$(sh "$SCRIPT_DIR/../../../packaging/version.sh" key desktop || true)"
 [ -n "$PKGVER" ] || { echo "ERROR: could not determine the build version" >&2; exit 1; }
 
 # Reproducible-ish: prefer the commit date over "now" so rebuilding the same

desktop/packaging/build-version.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env sh
-#
-# Echo the version this build should carry. One definition, used in three places
-# (both bundle jobs and the manifest writer) — if they ever disagreed, the app would
-# compare its own version against a manifest describing a different build, and the
-# updater would either offer nothing or loop forever offering the same thing.
-#
-# WHY DEV BUILDS NEED THEIR OWN VERSION AT ALL:
-# an updater decides by comparing semver. Every dev build carries the version in
-# Cargo.toml, so without this they'd all be `0.1.0` — an installed build would see a
-# manifest advertising the version it already has, conclude it was current, and never
-# update. The rolling channel needs a number that actually rises.
-#
-# The CI run number is that number: monotonic, already unique per build, and it needs
-# no state carried between runs. `0.1.0` + run 2932 becomes `0.1.2932`.
-#
-# Plain semver on purpose, NOT a `-dev.N` prerelease tag: prerelease versions sort
-# BELOW the release they qualify (`0.1.0-dev.5` < `0.1.0`), so a tagged build would
-# never update to a newer dev one, and Windows installer metadata wants a numeric
-# X.Y.Z anyway. Bumping the minor in Cargo.toml still wins over any dev build on the
-# old line, which is the ordering you want: 0.2.0 > 0.1.2932.
-set -eu
-
-CARGO_TOML="$(dirname "$0")/../src-tauri/Cargo.toml"
-base="$(grep -m1 '^version' "$CARGO_TOML" | sed -E 's/.*"([^"]+)".*/\1/')"
-
-# Dev builds only. Anything else (a v* tag, main) ships the version as written.
-if [ "${GITHUB_REF_NAME:-}" = "dev" ] && [ -n "${GITHUB_RUN_NUMBER:-}" ]; then
-  printf '%s.%s\n' "${base%.*}" "$GITHUB_RUN_NUMBER"
-else
-  printf '%s\n' "$base"
-fi