Add Windows desktop build and guarded release support

.github/workflows/ci.yml

@@ -405,6 +405,54 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
+  package-win:
+    needs: build-runtime-binaries
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: |
+            apps/desktop/package-lock.json
+            apps/ade-cli/package-lock.json
+
+      - name: Install desktop dependencies
+        run: cd apps/desktop && npm ci
+
+      - name: Install ADE CLI dependencies
+        run: cd apps/ade-cli && npm ci
+
+      - name: Download ADE runtime sidecars
+        uses: actions/download-artifact@v4
+        with:
+          pattern: ade-runtime-*
+          path: apps/desktop/resources/runtime
+          merge-multiple: true
+
+      - name: Validate Windows release contract
+        run: npm --prefix apps/desktop run test:win:release-contract
+
+      - name: Build and smoke unsigned Windows preview
+        env:
+          ADE_RELEASE_REPOSITORY: ${{ github.repository }}
+          ELECTRON_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron
+          ELECTRON_BUILDER_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron-builder
+        run: cd apps/desktop && npm run dist:win
+
+      - name: Upload Windows preview artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ade-win-preview-${{ github.sha }}
+          path: |
+            apps/desktop/release/*.exe
+            apps/desktop/release/*.exe.blockmap
+            apps/desktop/release/latest.yml
+          if-no-files-found: error
+          retention-days: 14
   validate-docs:
     needs: install
     runs-on: ubuntu-latest
@@ -449,6 +497,7 @@ jobs:
       - test-account-directory
       - build
       - build-runtime-binaries
+      - package-win
       - validate-docs
     runs-on: ubuntu-latest
     steps:

.github/workflows/prepare-release.yml

@@ -7,6 +7,10 @@ on:
         description: Version to release. Accepts 1.2.3 or v1.2.3.
         required: true
         type: string
+      target_sha:
+        description: Exact 40-character commit SHA on main to validate.
+        required: true
+        type: string
 
 permissions:
   actions: read
@@ -22,14 +26,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: main
+          ref: ${{ inputs.target_sha }}
           fetch-depth: 0
 
       - name: Resolve version and target commit
         id: resolve
         env:
           INPUT_VERSION: ${{ inputs.version }}
+          INPUT_TARGET_SHA: ${{ inputs.target_sha }}
         run: |
+          set -euo pipefail
+
           version="$(printf '%s' "$INPUT_VERSION" | tr -d '[:space:]')"
           if [ -z "$version" ]; then
             echo "::error::Version input cannot be empty."
@@ -46,8 +53,20 @@ jobs:
             exit 1
           fi
 
+          if ! printf '%s' "$INPUT_TARGET_SHA" | grep -Eq '^[0-9a-fA-F]{40}$'; then
+            echo "::error::target_sha must be the exact 40-character commit SHA approved for release."
+            exit 1
+          fi
+
+          requested_sha="$(printf '%s' "$INPUT_TARGET_SHA" | tr '[:upper:]' '[:lower:]')"
+          resolved_sha="$(git rev-parse HEAD)"
+          if [ "$resolved_sha" != "$requested_sha" ]; then
+            echo "::error::Checked out $resolved_sha instead of requested commit $requested_sha."
+            exit 1
+          fi
+
           echo "tag_name=$tag_name" >> "$GITHUB_OUTPUT"
-          echo "target_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "target_sha=$resolved_sha" >> "$GITHUB_OUTPUT"
 
   validate:
     needs: resolve