ci(desktop): recover signed Mac packages and finalize existing artifacts

[wgqqqqq]

Summary

A failed macOS package currently requires rebuilding the entire Desktop matrix, Linux CLI/Relay archives and Relay image. Add target_platform=macos-arm64|macos-x64 to build only the missing signed Mac artifact, and artifact_run_ids to finalize a complete release from the original and recovery runs without rebuilding successful products.

The default all matrix keeps its original five platform definitions and complete publication gate. A single Mac target retains the immutable source tag, channel, signing, notarization and updater signatures, with no release/feed/image publication. Finalization accepts exactly one artifact for every Desktop platform, both Linux CLI/Relay architectures and the Relay descriptor. Each source must be a protected-main Desktop Package run at or after the release tag, with a successful Prepare job and successful artifact producer. Missing, duplicate, expired or untrusted sources fail before downloading/publishing; the existing full manifest, signing and public readback checks remain in place.

Depends on #3409 for the pinned current-workflow Apple verification policy; merge that first. The release guide documents recovery and finalization. Native mobile is unchanged.

Verification

• pnpm run check:github-config: 42 passed, 1 existing pwsh skip.
• Executed platform selection for all targets, Relay-only combinations, valid finalization inputs and invalid combinations.
• Publication truth tables cover both Mac recovery targets, stable/beta, upload modes, every producer outcome, and failed/skipped Prepare during finalization.
• Finalization fixtures cover a complete split run, each failed/expired producer, missing/duplicate artifacts, untrusted sources, and stopping downloads when the protected-history check fails.
• Extracted matrix JSON has the original values for all five producers; git diff --check passed.

AI-assisted; locally tested with focused workflow fixtures. Hosted CI and the signed ARM64 recovery/finalization runs will provide packaging evidence. No product behavior, persisted data or remote protocol changes; remote scenarios were not exercised by these orchestration tests.