chore(deps): bump electron-builder to 26.15.3 and electron-updater to 6.8.9

[JamieRuderman]

Supersedes #1151 and #1150, which were both red and overlap on electron-builder. Doing the whole electron-builder family in one commit avoids the half-updated states those two produced.

Package	From	To
electron-builder	26.8.1	26.15.3
app-builder-lib	26.8.1	26.15.3
builder-util-runtime	9.3.1	9.7.0
electron-updater	6.6.2	6.8.9

All within the same major.

Why the dependabot PRs failed

npm ci refused the tree: dependabot updated electron/package-lock.json and electron/package.json but not the root package-lock.json, and since electron is a workspace of the root, the root lock is what npm ci resolves. It exited with Missing: string_decoder@1.1.1 from lock file and friends, so typecheck and CircleCI both failed before running anything. Both lockfiles are regenerated here, and npm ci --dry-run is clean against each.

Lockfile churn

The diff is large (~1100 insertions, ~2300 deletions) because 26.15.x drops the prebuilt app-builder-bin and 7zip-bin binaries in favor of pure-TS equivalents, with nativeRebuilder routing to @electron/rebuild. That also removes dmg-license, @develar/schema-utils and a chunk of the cacache tree. Nothing in this repo's scripts or build config referenced those.

Verification

• npm ci --ignore-scripts --dry-run clean for the root lock and for electron/package-lock.json — the exact failure from chore(deps): bump app-builder-lib and electron-builder in /electron #1151
• npx tsc -p common/tsconfig.json, root npm run typecheck, and npx tsc -p tsconfig.json --noEmit in electron/ all clean. The electron typecheck is the meaningful one for electron-updater: AutoUpdater.ts uses logger, disableWebInstaller, autoRunAppAfterInstall, forceDevUpdateConfig, allowPrerelease, getFeedURL(), checkForUpdatesAndNotify() and quitAndInstall(), and all still typecheck against 6.8.9's types
• npm test — 2 suites, 20 tests passing
• Real packaging run with the new builder: electron-builder --dir --mac --arm64 (unsigned, SKIP_SIGNING=true) completes — @electron/rebuild runs the native-dependency step, electron 39.8.10 is downloaded and extracted, and the app packs to a 314 MB bundle with electron-updater present in app.asar

What still needs a human

The packaging internals changed under us, so this deserves a real signed build before it ships — notarization on macOS, the SSL.com signtool path on Windows, and an auto-update check against a published release. None of that is reachable from CI on a PR. 26.15.2 also switched the macOS zip target to native zip to preserve .framework symlinks, and the mac zip is what feeds auto-update, so that path specifically is worth exercising on the next release candidate.

[aws-amplify-us-west-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-1183.d20k671nqqv4kl.amplifyapp.com