v0.3.21

ci: make a version-bump push release itself again; 0.3.21

Fixing `npm ci` unblocked the release jobs and exposed two more breakages
underneath, one on each remote. Neither had ever run to completion since
2026-06-24, so 0.3.15..0.3.20 published nowhere.

Nexus (forgejo): the job wrote its registry + auth to tools/server/.npmrc
and published from that directory. Since the workspaces migration that
directory is a workspace MEMBER, and npm >= 9 ignores a project .npmrc
inside one — "npm warn config ignoring workspace config at …" — so npm
fell back to registry.npmjs.org with no credentials and died ENEEDAUTH.
Write $HOME/.npmrc (user config) instead, which is read no matter where
the workspace root is. Verified both ways against a real `npm publish
--dry-run`: from tools/server the member .npmrc is ignored and npm targets
registry.npmjs.org, while $HOME/.npmrc targets Nexus.

npmjs (github): checkout was handed `token: ${{ secrets.RELEASE_PAT }}`,
a secret that was never created. GitHub maps an absent secret to the empty
string and checkout rejects an empty token, so the job died on step one —
"Input required and not supplied: token". The PAT existed only so the
pushed tag would re-trigger desktop.yml, since a tag pushed by
GITHUB_TOKEN fires no workflow. Drop it: check out with the default token
and dispatch desktop.yml explicitly with `gh workflow run --ref <tag>`,
which makes github.ref the tag so its Release-attach step behaves exactly
as on a tag push. The dispatch is non-fatal — a broken installer build
must not strand an already-published package.

Not done as a reusable `uses:` workflow call: Forgejo also parses
.github/workflows, and its runner would choke on that syntax rather than
merely skipping the job.

Also add workflow_dispatch to the Nexus release, so a publish that fails
after its tag is pushed can be re-run without inventing a version, and
delete the stale v0.3.20 tag that the half-succeeded run left behind —
it would have made the "already released?" gate skip the very publish it
guards.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>