ci(desktop): enforce app version matches release tag

.github/workflows/build-healthchat-desktop.yaml

@@ -17,9 +17,13 @@ name: Build HealthChat Desktop
 #   - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
 #     GitHub environments (secrets/vars) to be configured. Without them the builds still run but
 #     produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
-#   - The desktop app version comes from apps/desktop/package.json (electron-builder), NOT the tag
-#     (Windows squirrel rewrites any `version` override into a nightly string). Bump
-#     apps/desktop/package.json in the release commit if you want it to match the tag.
+#   - The desktop app version comes from apps/desktop/package.json (electron-builder); the per-job
+#     `version` input only feeds the macOS/Linux update manifest and is mangled into a nightly
+#     string by Windows squirrel, so it cannot set the app version. To keep the installers / About
+#     dialog in sync with the tag, apps/desktop/package.json must be bumped to the release version
+#     in the release commit. The "Assert desktop app version matches release" step below enforces
+#     this: the build fails fast if package.json drifts from the tag's MAJOR.MINOR.PATCH (any
+#     -rc1/-hotfix1 suffix is ignored, since squirrel requires a clean numeric version).
 
 on:
     push:
@@ -28,7 +32,7 @@ on:
     workflow_dispatch:
         inputs:
             version:
-                description: "Version (e.g. 1.4.0). Used for the web bundle version; the desktop app version comes from apps/desktop/package.json."
+                description: "Version (e.g. 1.4.0). Drives the web bundle version and must match apps/desktop/package.json (MAJOR.MINOR.PATCH), which sets the desktop app version."
                 required: true
                 type: string
             workspace_ref:
@@ -73,6 +77,24 @@ jobs:
                   fi
                   echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
+            # electron-builder bakes apps/desktop/package.json's version into the installers and the
+            # About dialog (the per-platform `version` input cannot override it). Fail fast if that
+            # file wasn't bumped to this release, so the desktop apps always match the tag. The
+            # comparison is on MAJOR.MINOR.PATCH only: tags may carry -rc1/-hotfix1 suffixes, but
+            # Windows squirrel needs package.json to stay a clean numeric version.
+            - name: Assert desktop app version matches release
+              env:
+                  VERSION: ${{ steps.version.outputs.version }}
+              run: |
+                  set -euo pipefail
+                  BASE=$(printf '%s' "$VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
+                  PKG=$(jq -r .version apps/desktop/package.json)
+                  if [[ "$PKG" != "$BASE" ]]; then
+                    echo "::error::apps/desktop/package.json version ($PKG) does not match release $BASE (tag: $VERSION). Bump apps/desktop/package.json to $BASE in the release commit so the desktop installers and About dialog match the tag."
+                    exit 1
+                  fi
+                  echo "Desktop app version $PKG matches release $BASE"
+
             - name: Resolve workspace ref
               id: workspace
               env: