release(desktop): prepare v3.8.41 native preflight

[wesleysimplicio]

Summary

• bump the first-party Desktop manifests to 3.8.41;
• record the reproducible macOS ARM64 preflight;
• verify the exact public Runtime v3.8.40 sidecar remains embedded in the app, ZIP, and DMG.

Verification

• Desktop unit tests: 50 files / 337 tests passed;
• TypeScript/Vite build passed;
• packaged release sidecar smoke passed;
• codesign --verify --deep --strict passed after local ad-hoc signing;
• ZIP and DMG extraction/mount checks preserved Runtime SHA-256 f8404218d89bb6599d2f83335d3419f86fe9f81730a53b9690639c0f9fee9a8e.

Explicitly blocked

This is intentionally a draft. It must not be merged or published as a completed release yet:

• no Developer ID identity or notarization; spctl rejects the ad-hoc app;
• Windows x64, Linux x64, and macOS Intel native build/install smoke are unavailable on this host;
• real clean-HOME Google OAuth/callback/logout evidence and screenshots were not captured;
• Desktop-container Ed25519 signatures, SBOM, and provenance were not generated;
• global repository validation still reports a checksum mismatch in the pre-existing ignored simplicio-linux-x64 artifact.

Refs #282, #283.