feat(release): expand desktop distribution to 8 assets + 2 package managers

Phases 3, 4, 5, 6 of the multi-platform distribution plan.

## create-release.yml rewrite
- Replace deprecated actions/create-release@v1 + upload-release-asset@v1 with
  softprops/action-gh-release@v2 (SHA-pinned)
- Expand build-desktop matrix: macos-13 (Intel), macos-14 (ARM),
  windows-latest, ubuntu-latest × 2 legs (deb+rpm, AppImage+tar.gz)
- Each matrix job uploads directly to release (no artifact round-trip — saves
  ~10 min + 1.5GB transfer per run)
- Inline portable archives: Windows .zip via 7z, Linux .tar.gz via tar
- linuxdeploy SHA-verified fetch for AppImage builds (not `continuous` tag)
- Per-asset size budget: hard fail at 1 GB per asset
- prerelease inferred from tag regex (-rc|-beta|-alpha|-dev|-snapshot)
- workflow_dispatch dry_run input: builds all assets without publishing,
  skips Android + bump workflows
- Tag-vs-libs.versions.toml assertion as first step in each matrix job
- Android + Quartz jobs preserved; migrated to softprops/action-gh-release@v2

## Package manager bump workflows (Homebrew + Winget)
- .github/workflows/bump-homebrew.yml — macauley/action-homebrew-bump-cask
  on ubuntu-latest (saves macOS runner quota). Cask name: `amethyst-nostr`.
- .github/workflows/bump-winget.yml — vedantmgoyal9/winget-releaser on
  windows-latest. PackageIdentifier: `VitorPamplona.Amethyst`.
- Shared composite action .github/actions/assert-stable-release rejects
  draft/prerelease/malformed-tag releases at action boundary (defense in
  depth vs workflow-level `if:` alone).
- Both workflows auto-open `release-ops`-labeled GH Issues on failure.
- Concurrency groups per tag prevent re-fire races.
- AUR + Scoop deferred to follow-up PR (unresolved ownership questions).

## Documentation
- BUILDING.md: per-platform build commands, asset naming contract, release
  runbook, bootstrap runbook, troubleshooting, uninstall paths, incident
  response, fallback plans (macos-13 retirement, Homebrew Sept 2026 deadline)
- README: expanded Download section with per-OS install matrix for 7 formats
  + 2 package managers. Deploying section points at BUILDING.md.

## Supply chain
- .github/dependabot.yml: monthly bumps for github-actions ecosystem
- All new third-party actions SHA-pinned:
  - softprops/action-gh-release v2.6.2
  - macauley/action-homebrew-bump-cask v4.0.0
  - vedantmgoyal9/winget-releaser v2
  - nick-fields/retry v3.0.2
- linuxdeploy binary SHA256-verified against pinned release tag

README.md

@@ -21,6 +21,8 @@ Join the social network you control.
 
 ## Download and Install
 
+### Android
+
 [<img src="./docs/design/zapstore.svg"
 alt="Get it on Zap Store"
 height="70">](https://github.com/zapstore/zapstore/releases)
@@ -33,6 +35,24 @@ height="70">](https://github.com/vitorpamplona/amethyst/releases)
      alt="Get it on Google Play"
      height="70">](https://play.google.com/store/apps/details?id=com.vitorpamplona.amethyst)
 
+### Desktop
+
+| OS | CLI install | Direct download |
+|---|---|---|
+| macOS (Apple Silicon) | `brew install --cask amethyst-nostr` | [.dmg arm64](https://github.com/vitorpamplona/amethyst/releases/latest) |
+| macOS (Intel) | `brew install --cask amethyst-nostr` | [.dmg x64](https://github.com/vitorpamplona/amethyst/releases/latest) |
+| Windows 10/11 | `winget install VitorPamplona.Amethyst` | [.msi](https://github.com/vitorpamplona/amethyst/releases/latest) · [.zip portable](https://github.com/vitorpamplona/amethyst/releases/latest) |
+| Debian/Ubuntu | — | [.deb](https://github.com/vitorpamplona/amethyst/releases/latest) |
+| Fedora/RHEL/openSUSE | — | [.rpm](https://github.com/vitorpamplona/amethyst/releases/latest) |
+| Any Linux | — | [AppImage](https://github.com/vitorpamplona/amethyst/releases/latest) · [.tar.gz](https://github.com/vitorpamplona/amethyst/releases/latest) |
+
+_Coming soon (separate PR): Scoop (Windows), AUR (Arch Linux)._
+
+**Build from source:** see [BUILDING.md](BUILDING.md).
+
+**Install troubleshooting** (Gatekeeper / SmartScreen / AppImage): see
+[BUILDING.md § Troubleshooting installs](BUILDING.md#troubleshooting-installs).
+
 </div>
 
 ## Supported Features
@@ -249,22 +269,18 @@ For the Play build:
 
 ## Deploying
 
-1. Generate a new signing key
-```
-keytool -genkey -v -keystore <my-release-key.keystore> -alias <alias_name> -keyalg RSA -keysize 2048 -validity 10000
-openssl base64 < <my-release-key.keystore> | tr -d '\n' | tee some_signing_key.jks.base64.txt
-```
-2. Create four Secret Key variables on your GitHub repository and fill in the signing key information
-    - `KEY_ALIAS` <- `<alias_name>`
-    - `KEY_PASSWORD` <- `<your password>`
-    - `KEY_STORE_PASSWORD` <- `<your key store password>`
-    - `SIGNING_KEY` <- the data from `<my-release-key.keystore>`
-3. Change the `versionCode` and `versionName` on `amethyst/build.gradle`
-4. Commit and push.
-5. Tag the commit with `v{x.x.x}`
-6. Let the [Create Release GitHub Action](https://github.com/vitorpamplona/amethyst/actions/workflows/create-release.yml) build a new `aab` file.
-7. Add your CHANGE LOG to the description of the new release
-8. Download the `aab` file and upload it to the PlayStore.
+Full release + bootstrap runbooks (Android AAB upload, desktop packaging,
+Homebrew cask, Winget manifest, Apple Developer signing budget time-box) live
+in [BUILDING.md § Release runbook](BUILDING.md#release-runbook) and
+[BUILDING.md § Bootstrap runbook (one-time)](BUILDING.md#bootstrap-runbook-one-time).
+
+TL;DR for cutting a release:
+
+1. Bump `app` in `gradle/libs.versions.toml` (e.g. `"1.08.1"`)
+2. Bump `versionCode` in `amethyst/build.gradle`
+3. `git commit -am "chore(release): 1.08.1" && git tag -s v1.08.1 && git push --tags`
+4. Wait for `Create Release Assets` workflow — 20 Android assets + 8 desktop assets go live on GH Release; Homebrew + Winget auto-bump on stable tags
+5. Upload AAB to Play Store manually (existing step)
 
 ## Using the Quartz library