image: bake every client in, not just the phone

~104 MB on top of ~85 MB, almost all of it the AppImage. That is what the product
being complete costs (rule 23): a self-hoster gets a working app for their machine
from the server holding their notes, with no account on a forge that is private.
The AppImage is not optional within that — it is the only bundle that can replace
itself in place, so a server without one cannot serve in-app updates to anybody.

`packaging/fetch-clients.sh` replaces the inline fetch and writes the fixed names
and sidecars `client_dist.py` reads. It never fails: a platform with nothing
published means the server advertises nothing for it and the UI hides that
download, and eight fetches must not become eight ways to redden a green lane.

THE VERSION IS FETCHED, NOT DERIVED, and this is the part that would have been
wrong the easy way. The obvious shortcut is `version.sh display desktop` in the
image job — it has the checkout. But this commit may not be the commit the channel
is serving: a push touching only `src/` does not rebuild the desktop, so the
channel still holds an older build and a locally-derived version would describe
those bytes with this commit's number. `client_dist.py`'s size check could not
catch it, because size IS measured from the real file — it would sail through and
lie about the version alone. So `write-manifest.sh` now publishes
`thoughtsync-desktop.json` beside `latest.json`, from the same two values in the
same breath, and only size/sha256 are measured at bake time.

Which needed the prune's keep-list, or the sidecar would have been uploaded and
deleted again in the same run — a fixed name is self-limiting, which is exactly
why that list exists.

`version_code` is NOT uniformly an integer, and coercing it was a leftover from
the days when Android was the only platform. Android's must stay a JSON number:
`ClientRelease` in core declares it `i64` and a string fails to deserialize on
every phone in the field. The desktop's is Tauri's semver key `1.0.<minutes>` —
the value its updater actually compares — and `int()` would have rejected every
desktop sidecar CI writes. The table now says which is which, and tests pin both
directions.

Also retires the comment above the fetch step, which claimed the APK came from
"always the rolling dev release" and mentioned `:<version>` images. M314 step 3
made the channel conditional in the code directly below it, and step 6 removed
version-shaped image tags entirely.

Verified against the live dev channel before pushing: the Android half resolves
and exits 0, the desktop half degrades with a warning because the sidecar does not
exist yet, and all five constructed bundle filenames return 200.

desktop/packaging/write-manifest.sh

@@ -24,6 +24,11 @@ set -euo pipefail
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required (owner/repo)}"
 : "${RELEASE_TAG:?RELEASE_TAG is required (the release holding the bundles)}"
 : "${APP_VERSION:?APP_VERSION is required (the version the bundles carry)}"
+# The version a PERSON reads, published beside the manifest so the image build can
+# describe the bundles it bakes in without re-deriving anything. Required rather
+# than defaulted: a missing value here would silently publish a sidecar naming the
+# wrong build, and there is nothing downstream that could catch it.
+: "${DISPLAY_VERSION:?DISPLAY_VERSION is required (the human-readable version)}"
 
 # The manifest is published to the release that HOLDS the bundles. There is no
 # second place any more.
@@ -116,27 +121,47 @@ pub_date="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
 echo "==> Manifest:"
 cat "$work/latest.json"
 
-# The manifest goes on the same release the bundles were just read from — which is
-# also the one `publish-release.sh` created or refreshed moments earlier, so it is
+# Both files go on the same release the bundles were just read from — which is also
+# the one `publish-release.sh` created or refreshed moments earlier, so it is
 # guaranteed to exist by the time this runs.
-target_id="$release_id"
-target_assets="$assets"
 
 # Replace rather than duplicate: Forgejo rejects a second asset with the same name,
-# and this file is rewritten on every publish by design.
-old_id="$(printf '%s' "$target_assets" \
-  | grep -oE "\"id\"[[:space:]]*:[[:space:]]*[0-9]+[^}]*\"name\"[[:space:]]*:[[:space:]]*\"latest\.json\"" \
-  | head -1 | grep -oE '[0-9]+' | head -1 || true)"
-if [ -n "${old_id:-}" ]; then
-  echo "==> Removing the previous latest.json (id $old_id)"
-  curl -fsS -X DELETE "${AUTH[@]}" "$API/releases/$target_id/assets/$old_id" >/dev/null
-fi
+# and these files are rewritten on every publish by design.
+replace_asset() {
+  local path="$1" name="$2" escaped old_id
+  escaped="${name//./\\.}"
+  old_id="$(printf '%s' "$assets" \
+    | grep -oE "\"id\"[[:space:]]*:[[:space:]]*[0-9]+[^}]*\"name\"[[:space:]]*:[[:space:]]*\"$escaped\"" \
+    | head -1 | grep -oE '[0-9]+' | head -1 || true)"
+  if [ -n "${old_id:-}" ]; then
+    echo "==> Removing the previous $name (id $old_id)"
+    curl -fsS -X DELETE "${AUTH[@]}" "$API/releases/$release_id/assets/$old_id" >/dev/null
+  fi
+  echo "==> Uploading $name to $RELEASE_TAG"
+  curl -fsS -X POST "${AUTH[@]}" "$API/releases/$release_id/assets?name=$name" \
+    -F "attachment=@$path" >/dev/null
+}
 
-echo "==> Uploading latest.json to $RELEASE_TAG"
-curl -fsS -X POST "${AUTH[@]}" "$API/releases/$target_id/assets?name=latest.json" \
-  -F "attachment=@$work/latest.json" >/dev/null
+replace_asset "$work/latest.json" "latest.json"
 
-echo "==> Done. $RELEASE_TAG now advertises $APP_VERSION for ${#entries[@]} platform(s)."
+# The version pair, for whoever needs to describe these bundles without rebuilding
+# them — today the image build, which bakes the desktop clients in and writes each
+# one a sidecar (`packaging/fetch-clients.sh`).
+#
+# It is published HERE, beside the manifest, because this is the step that speaks
+# for what the channel serves: both files are written in the same breath from the
+# same two values, so they cannot disagree about which build is current. A consumer
+# deriving the version from its own checkout instead would describe these bytes
+# with whatever commit it happened to be on.
+#
+# No `size` or `sha256` — those are per-artifact and there are four. Whoever
+# downloads a bundle measures the bytes it actually got, which is the only way to
+# tell a truncated download from a whole one.
+printf '{\n  "version_name": "%s",\n  "version_code": "%s"\n}\n' \
+  "$DISPLAY_VERSION" "$APP_VERSION" > "$work/thoughtsync-desktop.json"
+replace_asset "$work/thoughtsync-desktop.json" "thoughtsync-desktop.json"
+
+echo "==> Done. $RELEASE_TAG now advertises $DISPLAY_VERSION ($APP_VERSION) for ${#entries[@]} platform(s)."
 
 # --- prune superseded builds from a rolling channel ---------------------------
 #
@@ -169,7 +194,7 @@ if [ "${PRUNE_OLD_ASSETS:-false}" = "true" ]; then
         # every desktop push regardless. That is exactly what happened on run
         # 4098, which swept the APK run 4092 had just published.
         case "$asset_name" in
-          latest.json|thoughtsync.apk|thoughtsync-android.json) continue ;;
+          latest.json|thoughtsync-desktop.json|thoughtsync.apk|thoughtsync-android.json) continue ;;
           *"$APP_VERSION"*) continue ;;
         esac
         echo "    removing $asset_name"