feat(desktop): build signed Windows + macOS apps in healthchat pipeline

Extend the HealthChat desktop pipeline beyond Linux to produce fully branded,
signed Windows (.exe/.msi) and macOS (.dmg/.zip) installers, published to the
GitHub Release on the healthchat-v* tag alongside the web build.

- Add HealthChat desktop icons (icon.png/ico + Apple Icon Composer bundle),
  derived from apps/web/res/vector-icons/1024.png
- Point the reusable build workflows at this fork (new repository/ref inputs)
  so the Electron shell, icons and healthchat:// handler are fork-branded
- Relax hardcoded Element*/element-desktop* filename asserts to be
  product-name-agnostic
- Wire signed macOS + Windows jobs into build-healthchat-desktop.yaml, trigger
  it on healthchat-v* tags, and add a release job that uploads installers
- Map the org-level eSigner secrets to the CKA names the reusable expects
- Document signing setup (Apple env, eSigner mapping, ESIGNER_MODE=prod) in the
  desktop README and releasing-healthchat skill

apps/desktop/build/icon.icon/icon.json

@@ -5,8 +5,8 @@
             "layers": [
                 {
                     "glass": false,
-                    "image-name": "element.png",
-                    "name": "element"
+                    "image-name": "healthchat.png",
+                    "name": "healthchat"
                 }
             ],
             "name": "Figma",

apps/desktop/element.io/healthchat/README

@@ -45,18 +45,57 @@ CI
 --
 .github/workflows/build-healthchat-desktop.yaml builds the plugin + webapp artifact and
 feeds it into build_desktop_prepare.yaml (`config: element.io/healthchat`,
-`webapp-artifact: healthchat-webapp`) and build_desktop_linux.yaml.
+`webapp-artifact: healthchat-webapp`) and the per-platform build_desktop_{linux,macos,windows}.yaml
+reusables. It runs on every `healthchat-v*` tag (alongside the web build) and via
+workflow_dispatch. The reusables are pointed at THIS fork (`repository`/`ref` inputs) so the
+Electron shell, icons and the healthchat:// deep-link handler are fork-branded. On a tag push the
+`release` job attaches the .dmg / .zip / .exe / .msi / .deb / .tar.gz to the GitHub Release.
 
-Open items before a production release
---------------------------------------
+Branding assets
+---------------
+App icons live in apps/desktop/build/ and are HealthChat-branded, derived from
+apps/web/res/vector-icons/1024.png:
+  - icon.png   (Linux, 512x512)
+  - icon.ico   (Windows, multi-resolution)
+  - icon.icon/ (macOS Apple Icon Composer bundle; Assets/healthchat.png + icon.json)
+Regenerate after a logo change with ImageMagick:
+  magick apps/web/res/vector-icons/1024.png -resize 512x512 apps/desktop/build/icon.png
+  magick apps/web/res/vector-icons/1024.png -define icon:auto-resize=16,24,32,48,64,128,256 apps/desktop/build/icon.ico
+  cp apps/web/res/vector-icons/1024.png apps/desktop/build/icon.icon/Assets/healthchat.png
+
+Signing (required for trusted installers)
+-----------------------------------------
+The macos/windows jobs run with sign: true, which gates on these GitHub environments. Create
+them under repo Settings -> Environments with the listed secrets/variables:
+
+  Desktop Apple   (macOS notarisation)
+    secrets:  APPLE_ID                 Apple ID email of the signing account
+              APPLE_ID_PASSWORD        app-specific password (NOT the Apple ID password)
+              APPLE_CSC_LINK           base64 of the Developer ID Application .p12
+              APPLE_CSC_KEY_PASSWORD   password for that .p12
+    variables: APPLE_TEAM_ID           Apple Developer Team ID
+
+  Windows code-signing (SSL.com eSigner CKA)
+    The reusable signs via eSigner CKA and expects ESIGNER_USER_NAME / ESIGNER_USER_PASSWORD /
+    ESIGNER_USER_TOTP. The Novaloop org already provides CodeSignTool-style secrets under
+    different names (ESIGNER_USERNAME / ESIGNER_PASSWORD / ESIGNER_TOTP_SECRET); the windows job
+    in build-healthchat-desktop.yaml maps them. CKA does not use credential_id. These org secrets
+    are scoped to "private and internal repositories", so this fork must stay internal/private.
+    Set repo or org variable ESIGNER_MODE=prod for a trusted signature (defaults to the untrusted
+    sandbox demo cert).
+
+Without these the jobs still build but produce unsigned/untrusted output. Because element-web is
+a public-history fork, add environment/branch protection so only release/healthchat + healthchat-v*
+runs can reach the signing credentials.
+
+Open items
+----------
   - api_base_url: confirm the production API origin in config.json (currently assumed
     https://healthchat.ch). On desktop this MUST be absolute (vector:// origin can't reach
     a relative /api).
-  - Fork vs upstream shell: build_desktop_prepare.yaml / build_desktop_linux.yaml check out
-    element-hq/element-web (upstream). The webapp + variant are HealthChat's, but the Electron
-    shell (electron-main, icons) is upstream. Point those workflows at this fork to fully brand
-    the shell, and to guarantee the `/modules` -> `/webapp/modules` rewrite is present.
-  - macOS/Windows: need signing/notarization secrets; add the macos/windows reusable workflows
-    once configured.
-  - Deploy target: the upstream deploy job pushes to packages.element.io / Cloudflare R2 — wire
-    up a HealthChat distribution target instead.
+  - App version: the desktop app version comes from apps/desktop/package.json (Windows squirrel
+    rewrites any `version` override into a nightly string), NOT the healthchat-v tag. Bump
+    apps/desktop/package.json in the release commit if you want the About dialog / installer
+    filenames to match the tag.
+  - Auto-update: not wired up. The apps install from the GitHub Release but do not self-update.
+    Adding it needs a hosted update feed (releases.json / RELEASES) on a stable URL.