fix(desktop): align installer versions with OpenBot releases

[davidmckayv]

Desktop installers were labeled 0.0.0 regardless of the OpenBot release. Tauri now reads the root package.json version, the release workflow synchronizes the desktop Cargo manifest/lockfile, and CI rejects drift. Internal builds use X.Y.Z-internal.g<commit> so testers can identify their build.

Both packaging workflows set the version before compilation and signing. macOS keeps numeric system version fields and records the full internal identifier separately. Verification reads the app inside the finished DMG and checks both the extracted Windows app and NSIS installer, so temporary build-output cleanup cannot invalidate the checks.

Validation:

• 20 version regression tests / 59 assertions; 29 Windows signing regression cases; desktop typecheck, scoped formatting/lint and workflow validation passed.
• Mac DMG integrity, embedded version/source SHA, strict ad-hoc signature, and launch from a copy of the mounted image passed. Mac CI payload verification also passed.
• Protected Windows signing run passed. Both executables embed 0.0.10-internal.g2e08432d9404, have valid timestamped Tawkit, Inc. signatures, and downloaded hashes match the evidence. Windows test artifacts / signature evidence.

The distributed test pair uses commit 2e08432; the follow-up commit only corrects Mac CI verification. Application source is identical. Mac builds are ad-hoc signed for internal testing, without Apple notarization. No public release is published.

Closes FOR-305.

[linear-code]

FOR-305