Cox Desktop 0.2.3

Cox Desktop 0.2.3

macOS releases now provide DMG only, without duplicate ZIP packages.
The previous 442–461 MB Actions artifacts combined a DMG and a ZIP containing the same app;
this was not the size of a single installer.

• Generate and upload only DMG installers for Apple Silicon and Intel Macs.
• Keep Windows x64 EXE installers unchanged.
• Retain bundled and client-only variants, with both version numbers in combination filenames.
• Name release-build artifacts cox-desktop-* consistently.
• Verify signatures of the actual mounted DMG application and its embedded Node runtime.
• Add regression coverage preventing ZIP installers and ZIP sidecars from returning.
• Follow the OS language in native update, permission, quit, startup/error dialogs and custom
  menu labels: Chinese for Chinese system locales, English fallback otherwise. Never show both.
• Wait for ongoing checks/downloads before completing a download request. Distinguish
  checking, downloading, ready, incompatible and failed states instead of reporting them as up to date.

Bundled installers include Cox 0.1.42. Client-only installers include standalone Node/npm and
install the official Cox package on first launch; their first launch requires internet.
Subsequent launches reuse the installed backend offline. Backend updates are staged without
interrupting tasks and activated on the next normal launch, with paired data/code rollback.

Validation

• Source: 7c2e56ce75fe656ee579587b3beb7fb4671882c3.
• Complete main CI.
• Six native pre-release jobs:
  bundled/client-only on macOS ARM, macOS Intel and Windows x64, including real app startup.
• Native release builds verify the distributed DMG signatures before application smoke tests.
• All six native release jobs
  passed before publication.
• Public downloads are checked against their SHA-256 files and build-version/source metadata.

macOS packages currently use ad-hoc signing without Developer ID notarization, so Gatekeeper
may still require explicit approval. Windows packages are not publisher-signed.
This release does not restart or deploy any existing local Cox service.