feat(release): publish desktop updates from a tag through one feed

Desktop clients had two competing update sources: the runtime pointed at a
legacy GitLab registry while the Forgejo packages were filled in by
hardcoded, version-pinned scripts. Operators could not tell which feed was
authoritative, and no release could be reproduced from a tag.

Auto-update now reads a single canonical Forgejo registry feed, updated by
a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and
GitHub CI alike. Channel, minimum supported version, forced install,
full-versus-delta thresholds, staged rollout, and a remote kill switch come
from one policy file the client fetches alongside the feed. Tag creation is
gated on a clean tree, matching version surfaces, and a changelog section.

apps/desktop/electron-builder.yml

@@ -19,13 +19,13 @@ files:
 # 자동 업데이트 feed — 이 설정이 있어야 electron-builder가
 # latest.yml / latest-mac.yml (update info)를 생성한다.
 # generic provider는 파일 생성만 트리거하고 직접 업로드는 하지 않음
-# (업로드는 scripts/ci/publish-gitlab-release.mjs 담당).
-# d3r0/voice 프로젝트 ID = 1172 —
+# (업로드는 scripts/ci/publish-forgejo-release.mjs 담당).
+# canonical 호스트 = Forgejo (git.chanpaca.net/yunchan/d3ro-voice).
 # src/main/update-feed.ts의 UPDATE_FEED_URL과 반드시 동일 값 유지.
 # ────────────────────────────────────────────────────────────────────
 publish:
   provider: generic
-  url: "https://gitlab.twentyoz.kr:8443/api/v4/projects/1172/packages/generic/d3ro-voice/latest"
+  url: "https://git.chanpaca.net/api/packages/yunchan/generic/d3ro-voice/latest"
 
 # prerelease 버전(0.1.1-alpha)에서 채널을 "alpha"로 감지해 alpha.yml을 만드는 동작 차단 —
 # electron-updater(기본 채널 latest)가 latest.yml을 찾으므로 항상 latest 채널로 고정.