ci(release): gate OSS desktop auto-update promotion (#5398)

## Summary

Separate OSS desktop artifact publication from fleet-wide auto-update
promotion.

- retain the exact generated updater manifest as `updater-manifest.json`
on each immutable `desktop-vX.Y.Z` release
- stop the tag-triggered build from mutating
`buzz-desktop-latest/latest.json`
- add a `main`-only manual promotion workflow with one global
concurrency group
- validate stable semver, release/tag commit identity, draft/prerelease
state, exact platform set, signatures, version-bound asset URLs, asset
existence, monotonicity, idempotent retries, and a final stale-state
check before writing
- document the operator flow and pin the split with focused contract
tests

## Safety behavior

Publishing a versioned GitHub release no longer exposes it through the
in-app updater. Operators can install and test those exact
signed/notarized artifacts, then manually run **Promote OSS Desktop
Auto-Update** with the stable version.

Promotion rejects downgrades. A same-version retry succeeds only when
the rolling and candidate manifests are byte-identical. The workflow
re-reads the current rolling version immediately before its only write
and records the actor, source tag commit, previous version, manifest
digest, and run URL.

## Verification

Verified at commit `39caf1603be06bb476905225ec55f7bbbe86b237`:

```text
scripts/test-oss-desktop-promotion.sh
OSS desktop promotion contract passed

scripts/test-release-ref-contract.sh
release ref contract passed

git diff --check origin/main...HEAD
(clean)
```

The repository pre-push hook also passed `branch-skew` for the exact
pushed head; package suites were correctly skipped because this change
only touches release workflows, scripts, and documentation.

Originating conversation: Buzz channel `separate-publish-step-release`,
thread
`8857ce8bbe928e891165eddcf06c666cf6eae16181c3f02a6d8c396d8a536026`.

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>

RELEASING.md

@@ -173,10 +173,10 @@ for distributable builds or builds from an immutable release tag.
 `release.yml` has no manual dispatch and cannot build from `main` or another
 caller-selected ref. If a run for an existing immutable
 `desktop-v<version>` tag fails, rerun that failed workflow from GitHub Actions
-(or use `gh run rerun <run-id> --failed --repo block/buzz`). A stable rerun also
-repairs `buzz-desktop-latest/latest.json` if the original run published the
-versioned release but failed during that final rolling-manifest upload. Do not
-recreate, move, or push the immutable tag again.
+(or use `gh run rerun <run-id> --failed --repo block/buzz`). A rerun
+repairs the versioned draft if publication did not complete. It does not
+promote that version to the auto-updater; promotion is a separate manual
+action. Do not recreate, move, or push the immutable tag again.
 
 Mobile intentionally has no branch or arbitrary-ref fallback. The private
 Buildkite pipeline accepts only an exact candidate tag.
@@ -200,8 +200,25 @@ for the rest of the private pipeline contract.
 
 Desktop publishes two GitHub releases:
 
-1. **`desktop-v<version>`**: the user-facing release with installers.
-2. **`buzz-desktop-latest`**: the rolling auto-updater release.
+1. **`desktop-v<version>`**: the user-facing release with installers and the
+   exact `updater-manifest.json` promotion candidate. Publishing this release
+   does not expose it through in-app auto-update.
+2. **`buzz-desktop-latest`**: the rolling auto-updater release. Its
+   `latest.json` changes only through the manual promotion workflow.
+
+### Promote an OSS desktop release to auto-update
+
+After installing and testing the published `desktop-v<version>` artifacts, run
+**Promote OSS Desktop Auto-Update** from the `main` branch and enter the exact
+stable `X.Y.Z` version. The workflow validates the immutable tag and release,
+the retained manifest and every referenced updater asset, and requires the
+version to be newer than the currently promoted version before replacing
+`buzz-desktop-latest/latest.json`. Same-version retries succeed only when the
+manifest is identical; downgrades are rejected.
+
+Withholding promotion leaves existing clients on the previous version. If a
+promoted release is bad, ship and promote a higher patch version; changing the
+manifest to an older version does not downgrade clients that already updated.
 
 Mobile publishes only annotated `mobile-vX.Y.Z-rc.N` git tags. Store artifacts
 and rollout records retain the exact tag they used. Mobile does not publish a