feat: enforce desktop acceptance certification gates

[ksamaschke]

Summary

• expand desktop validation into an explicit acceptance/certification matrix per supported target
• add a fail-closed desktop release validator and certification report workflow gate before draft creation/promotion
• cover install/sync/publish control-plane flows, updater lifecycle, and recovery behavior in focused desktop tests

Testing

• npm test
• npm run build:desktop:release
• npm run build:quick && node --test dist/tests/installer/control-plane-client.test.js dist/tests/installer/desktop-control-plane.test.js dist/tests/installer/desktop-preview-startup.test.js dist/tests/installer/desktop-release-packaging.test.js dist/tests/installer/desktop-rollout-validation.test.js dist/tests/installer/desktop-shell-ux.test.js dist/tests/installer/desktop-updater.test.js
• ./scripts/release/build-artifacts.sh v12.3.0 HEAD && node scripts/release/validate-desktop-release.mjs --write-certification-report && node scripts/release/validate-desktop-release.mjs (expected fail-closed locally on incomplete single-platform artifacts)

Closes #186
Implements #187
Implements #188
Implements #189