ci: build windows/linux/macos desktop clients

[madeye]

Summary

• release.yml: new desktop job building installable packages of the Tauri GUI:
  • macOS — .dmg for aarch64-apple-darwin + x86_64-apple-darwin. The bundler builds the .app, then CI injects gfwlist.txt + GeoLite2-Country.mmdb into Contents/MacOS (next to the bundled client, where auto-discovery looks), re-signs ad-hoc, and creates the dmg with hdiutil (more reliable on CI than the bundler's AppleScript dmg step).
  • Linux — .deb + .AppImage for x86_64-unknown-linux-gnu (aarch64 skipped: WebKitGTK has no practical cross-compile story on a GitHub runner).
  • Windows — NSIS -setup.exe for x64 and ARM64, installing gfwlist.txt, GeoLite2-Country.mmdb, the matching-arch wintun.dll, and THIRD-PARTY-NOTICES.txt next to the exe via bundle resources.
• Every package bundles the matching-arch shadowvpn-client as a Tauri externalBin sidecar — it lands next to the app executable, exactly where the app's app_dir resolution and the client's bundled-data auto-discovery look.
• The sidecar/resources wiring lives in a CI-generated --config overlay, not tauri.conf.json, so local cargo run still needs no pre-staged files. On tag builds the overlay also stamps the release version into the installer metadata.
• ci.yml: new desktop check job (fmt + clippy) on ubuntu/macos/windows — the desktop crate previously had zero CI coverage, and its cfg(target_os) elevation/kill paths need per-OS compilation to be checked at all.
• README/gitignore updated to match (the stale "bundle.active: false / installable build is future work" paragraph).

Test plan

• actionlint clean on both workflows; YAML parses.
• Full macOS pipeline verified locally: overlay build places the shadowvpn-client sidecar in Contents/MacOS, data injection + ad-hoc re-sign passes codesign --verify --deep --strict, hdiutil produces a 9 MB dmg.
• Will dispatch release.yml on this branch to exercise all five desktop matrix entries before merging.

🤖 Generated with Claude Code