feat(desktop): build signed Windows + macOS apps in healthchat pipeline

Extend the HealthChat desktop pipeline beyond Linux to produce fully branded,
signed Windows (.exe/.msi) and macOS (.dmg/.zip) installers, published to the
GitHub Release on the healthchat-v* tag alongside the web build.

- Add HealthChat desktop icons (icon.png/ico + Apple Icon Composer bundle),
  derived from apps/web/res/vector-icons/1024.png
- Point the reusable build workflows at this fork (new repository/ref inputs)
  so the Electron shell, icons and healthchat:// handler are fork-branded
- Relax hardcoded Element*/element-desktop* filename asserts to be
  product-name-agnostic
- Wire signed macOS + Windows jobs into build-healthchat-desktop.yaml, trigger
  it on healthchat-v* tags, and add a release job that uploads installers
- Map the org-level eSigner secrets to the CKA names the reusable expects
- Document signing setup (Apple env, eSigner mapping, ESIGNER_MODE=prod) in the
  desktop README and releasing-healthchat skill

.github/workflows/build_desktop_linux.yaml

@@ -4,6 +4,10 @@
 on:
     workflow_call:
         inputs:
+            repository:
+                type: string
+                required: false
+                description: "The repository to checkout the desktop source from, defaults to element-hq/element-web"
             ref:
                 type: string
                 required: false
@@ -93,7 +97,7 @@ jobs:
 
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
-                  repository: element-hq/element-web
+                  repository: ${{ inputs.repository || 'element-hq/element-web' }}
                   ref: ${{ inputs.ref }}
                   persist-credentials: false
 
@@ -212,7 +216,7 @@ jobs:
                       assert_contains_string "$LIBS" "libsqlcipher.so.0"
                   fi
 
-                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
+                  ./scripts/glibc-check.sh dist/linux-*unpacked/*-desktop*
               env:
                   ARCH: ${{ steps.config.outputs.arch }}
 
@@ -230,9 +234,9 @@ jobs:
               if: contains(inputs.targets, 'deb')
               working-directory: apps/desktop
               run: |
-                  test -f ./dist/element-desktop*$ARCH.deb
+                  test -f ./dist/*-desktop*$ARCH.deb
 
-                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/element-desktop*.deb | tar -tv)
+                  DEB_LISTING=$(dpkg-deb --fsys-tarfile ./dist/*-desktop*.deb | tar -tv)
                   echo "deb listing: "
                   echo "$DEB_LISTING"
                   ! echo "$DEB_LISTING" | grep '^h'
@@ -243,9 +247,9 @@ jobs:
               if: contains(inputs.targets, 'tar.gz')
               working-directory: apps/desktop
               run: |
-                  test -f ./dist/element-desktop*.tar.gz
+                  test -f ./dist/*-desktop*.tar.gz
 
-                  TAR_GZ_LISTING=$(tar -tvf ./dist/element-desktop*.tar.gz)
+                  TAR_GZ_LISTING=$(tar -tvf ./dist/*-desktop*.tar.gz)
                   echo "tar.gz listing: "
                   echo "$TAR_GZ_LISTING"
                   ! echo "$TAR_GZ_LISTING" | grep '^h'
@@ -259,7 +263,7 @@ jobs:
             project: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
             artifact: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
             runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
-            executable: /opt/Element*/element-desktop*
+            executable: /opt/*/*-desktop*
             prepare_cmd: |
                 sudo apt-get -qq update
                 sudo apt install ./dist/*.deb