feat(desktop): build signed Windows + macOS apps in healthchat pipeline

Extend the HealthChat desktop pipeline beyond Linux to produce fully branded,
signed Windows (.exe/.msi) and macOS (.dmg/.zip) installers, published to the
GitHub Release on the healthchat-v* tag alongside the web build.

- Add HealthChat desktop icons (icon.png/ico + Apple Icon Composer bundle),
  derived from apps/web/res/vector-icons/1024.png
- Point the reusable build workflows at this fork (new repository/ref inputs)
  so the Electron shell, icons and healthchat:// handler are fork-branded
- Relax hardcoded Element*/element-desktop* filename asserts to be
  product-name-agnostic
- Wire signed macOS + Windows jobs into build-healthchat-desktop.yaml, trigger
  it on healthchat-v* tags, and add a release job that uploads installers
- Map the org-level eSigner secrets to the CKA names the reusable expects
- Document signing setup (Apple env, eSigner mapping, ESIGNER_MODE=prod) in the
  desktop README and releasing-healthchat skill

.github/workflows/build_desktop_windows.yaml

@@ -18,6 +18,10 @@ on:
             ESIGNER_USER_TOTP:
                 required: false
         inputs:
+            repository:
+                type: string
+                required: false
+                description: "The repository to checkout the desktop source from, defaults to element-hq/element-web"
             ref:
                 type: string
                 required: false
@@ -116,7 +120,7 @@ jobs:
 
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
-                  repository: element-hq/element-web
+                  repository: ${{ inputs.repository || 'element-hq/element-web' }}
                   ref: ${{ inputs.ref }}
                   persist-credentials: false
 
@@ -290,21 +294,21 @@ jobs:
             - name: Assert executable is present
               working-directory: apps/desktop
               run: |
-                  Test-Path './dist/win-*unpacked/Element*.exe'
+                  Test-Path './dist/win-*unpacked/*.exe'
 
             - name: Assert all Squirrel files are present
               if: contains(inputs.targets, 'squirrel')
               working-directory: apps/desktop
               run: |
-                  Test-Path './dist/squirrel-windows*/Element Setup*.exe'
-                  Test-Path './dist/squirrel-windows*/element-desktop-*-full.nupkg'
+                  Test-Path './dist/squirrel-windows*/* Setup*.exe'
+                  Test-Path './dist/squirrel-windows*/*-full.nupkg'
                   Test-Path './dist/squirrel-windows*/RELEASES'
 
             - name: Assert MSI is present
               if: contains(inputs.targets, 'msi')
               working-directory: apps/desktop
               run: |
-                  Test-Path './dist/Element*.msi'
+                  Test-Path './dist/*.msi'
 
     test:
         name: Test Windows ${{ inputs.arch }}
@@ -315,6 +319,6 @@ jobs:
             project: win-${{ inputs.arch }}
             artifact: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
             runs-on: ${{ inputs.test-runs-on || (inputs.arch == 'arm64' && 'windows-11-arm' || 'windows-2022') }}
-            executable: ./dist/win*-unpacked/Element*.exe
+            executable: ./dist/win*-unpacked/*.exe
             blob_report: ${{ inputs.blob_report }}
             args: ${{ inputs.test-args }}