chore(ci): build the desktop app while the CLI builds - #56072

Stacked on #56071 (desktop-release-files) ("chore(ci): upload only the desktop release files"). That is stacked on #56070 (cli-target-jobs) ("chore(ci): build each CLI target in its own job and sign macOS and Windows in parallel"), which is stacked on #55987 (release-runner-moves). Only the last commit belongs to this PR. It needs #56070 (cli-target-jobs), because it waits for that PR's per-target cli-unsigned-<target> artifacts.

Summary

Desktop legs now build the app while build-cli runs, instead of waiting for all of it; only Prepare needs the CLI. Beta does this since #55919.

• build-electron needs only version. New order: setup, "Build app" (electron-vite build), "Wait for the CLI", the CLI download, "Azure login" (Windows), Prepare, Package.
• The old Build step is removed. Its prebuild hook repeated Prepare, including a second CLI signing. Prepare now signs once; Package signs again as before.
• Azure login moves to just before Prepare, unlike beta. The OIDC token expires after 5 minutes, and dev's Prepare makes the first signing request, so beta's order would fail if a Windows CLI leg ran about 4 minutes late.
• script/wait-for-artifact.ts is byte-identical to beta's. It polls every 5 s and fails on producer failure or after 30 minutes.
• Workflow permissions gain actions: read. A job-level block would drop the id-token: write that Windows azure/login needs.

Expected effect

All figures are estimates from reference runs, not measured on the new layout.

• A leg gains about min(C, P): C is version end to the slowest build-cli leg (estimated 82–135 s, unmeasured on dev), P the leg's pre-CLI time.
• Critical path: about 1.4–1.9 min off a dev release (about 1 min if dev's CLI legs match beta's). linux-arm64 is the slowest leg (P 96–115 s in 38536124977, 38785024495, 38849200524) and the one to watch.
• Dropping the second prebuild saves 0.2–6 s per leg.
• Runner cost: short legs idle in the wait (Linux x64 0.5–1.5 min, Windows up to a minute): a few Blacksmith minutes per release.

Evidence

• Same output: a local A/B build (new vs. old order) matched all 3,686 files in out/ except .map build noise.
• Beta ran this order on all six targets in 38849200524 and 38847224136; both succeeded.
• Script behaved as expected locally against finished runs: artifact present, producer failed, no artifact, skipped job, unmatched name, and a re-run attempt (38785024495).

Things to know

• More jobs at once: 12 CLI, 4 Blacksmith and 2 macos-26 legs start together. Windows legs already queue 49–217 s, off the critical path.
• A failed build-cli leg fails its desktop leg and skips publish, but the other five legs run to the end (notarization, Sentry upload). "Re-run failed jobs" then re-runs only what failed.
• Use "Re-run failed jobs", not "Re-run all jobs". A full re-run can bundle attempt 1's CLI: wrong if attempt 1 already published to npm, and always on beta, where versions include the attempt. A current-attempt guard is a follow-up.
• Coupled to matrix naming: a name: or second matrix key on build-cli turns fail-fast into a 30-minute wait.
• Wait failure modes: no retry, so one 5xx, 403/429 or network error fails the leg. The 30-minute cap includes producer queue time. Six legs waiting over ~7 min could exhaust the 1,000/hour GITHUB_TOKEN limit. All 12 beta waits took 0–6 s. Recovery: "Re-run failed jobs".
• Sentry gets sourcemaps before build-cli finishes, so a failed CLI leg leaves them there.
• actions: read is read-only on a public repo.
• Typecheck: a scoped strict tsc reports an unreachable TS2345 in the script, kept identical to beta's.

Next merge of dev into beta:

• publish.yml goes from 3 to 7 conflict hunks: the actions: read comment, the build-electron header, the removed top download step, and beta's build/wait/Prepare block against "Build app".
• Keep Azure login right before Prepare, and beta's "Beta packaging settings" step.
• Never combine beta's github.ref_name != 'beta' exclusion on build-cli with dev's wait: every beta desktop leg would time out after 30 minutes. Drop the exclusion, or keep build-cli-beta with beta's own wait and download behind github.ref_name == 'beta'.

Verification

publish.yml can't run on this PR.

On the first dev release dispatch:

• All six build-electron legs start right after version.
• "Build app" runs only electron-vite (no icons, no signing).
• The wait logs ready after Ns: macOS and linux-arm64 0 to ~30 s, Linux x64 up to ~1.5 min.
• Windows: Azure login runs right after the CLI download.
• Prepare signs the CLI once and updates the version.
• Package, notarization and Windows signature check pass.
• linux-arm64 Prepare and publish start about 1.4–1.9 min earlier (estimate).
• Installed builds report the release version.

Rollback: revert this commit.