feat(desktop): build signed Windows + macOS apps in healthchat pipeline

Extend the HealthChat desktop pipeline beyond Linux to produce fully branded,
signed Windows (.exe/.msi) and macOS (.dmg/.zip) installers, published to the
GitHub Release on the healthchat-v* tag alongside the web build.

- Add HealthChat desktop icons (icon.png/ico + Apple Icon Composer bundle),
  derived from apps/web/res/vector-icons/1024.png
- Point the reusable build workflows at this fork (new repository/ref inputs)
  so the Electron shell, icons and healthchat:// handler are fork-branded
- Relax hardcoded Element*/element-desktop* filename asserts to be
  product-name-agnostic
- Wire signed macOS + Windows jobs into build-healthchat-desktop.yaml, trigger
  it on healthchat-v* tags, and add a release job that uploads installers
- Map the org-level eSigner secrets to the CKA names the reusable expects
- Document signing setup (Apple env, eSigner mapping, ESIGNER_MODE=prod) in the
  desktop README and releasing-healthchat skill

.github/workflows/build_desktop_macos.yaml

@@ -13,6 +13,10 @@ on:
             APPLE_CSC_LINK:
                 required: false
         inputs:
+            repository:
+                type: string
+                required: false
+                description: "The repository to checkout the desktop source from, defaults to element-hq/element-web"
             ref:
                 type: string
                 required: false
@@ -79,7 +83,7 @@ jobs:
 
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
-                  repository: element-hq/element-web
+                  repository: ${{ inputs.repository || 'element-hq/element-web' }}
                   ref: ${{ inputs.ref }}
                   persist-credentials: false
 
@@ -206,13 +210,13 @@ jobs:
               if: contains(inputs.targets, 'zip')
               working-directory: apps/desktop
               run: |
-                  test -f ./dist/Element*-mac.zip
+                  test -f ./dist/*-mac.zip
 
             - name: Assert dmg is present
               if: contains(inputs.targets, 'dmg')
               working-directory: apps/desktop
               run: |
-                  test -f ./dist/Element*.dmg
+                  test -f ./dist/*.dmg
 
     test:
         name: Test macOS Universal
@@ -223,12 +227,12 @@ jobs:
             project: macos
             artifact: ${{ inputs.artifact-prefix }}macos
             runs-on: macos-14
-            executable: /Users/runner/Applications/Element*.app/Contents/MacOS/Element*
+            executable: /Users/runner/Applications/*.app/Contents/MacOS/*
             # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
             # read-only and thus would not allow us to override the fuses as is required for Playwright.
             prepare_cmd: |
                 hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
-                rsync -a /Volumes/Element/Element*.app ~/Applications/ &&
+                rsync -a /Volumes/Element/*.app ~/Applications/ &&
                 hdiutil detach /Volumes/Element
             blob_report: ${{ inputs.blob_report }}
             args: ${{ inputs.test-args }}