feat(release): publish desktop updates from a tag through one feed

Desktop clients had two competing update sources: the runtime pointed at a
legacy GitLab registry while the Forgejo packages were filled in by
hardcoded, version-pinned scripts. Operators could not tell which feed was
authoritative, and no release could be reproduced from a tag.

Auto-update now reads a single canonical Forgejo registry feed, updated by
a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and
GitHub CI alike. Channel, minimum supported version, forced install,
full-versus-delta thresholds, staged rollout, and a remote kill switch come
from one policy file the client fetches alongside the feed. Tag creation is
gated on a clean tree, matching version surfaces, and a changelog section.

scripts/ci/sync-version.mjs

@@ -74,7 +74,6 @@ const packageManifestPaths = [
   'package.json',
   'apps/admin/package.json',
   'apps/desktop/package.json',
-  'apps/mobile/package.json',
   'apps/mobile-rn/package.json',
   'apps/web/package.json',
   'packages/api-client/package.json',
@@ -129,10 +128,6 @@ if (existsSync(join(root, 'site', 'package-lock.json'))) {
   })
 }
 
-updateText('apps/mobile/app.config.ts', (text) =>
-  replaceExactlyOnce(text, /version: '[^']+',/, `version: '${metadata.version}',`, 'Expo version'),
-)
-
 updateText('apps/mobile-rn/android/app/build.gradle', (text) => {
   let next = replaceExactlyOnce(
     text,