fix(ci): recover desktop package retries and show artifact downloads

[GCWing]

Summary

Desktop Package retries can fail before any build when checkout_ref is absent from the checked-out branch history. The prepare job now fetches that ref explicitly, pins its commit, and retains the immutable release-tag check. Every successful platform also records its artifact download link and source SHA in the job summary.

Type and Areas

Bug fix; desktop release workflow and release-source resolution.

Motivation / Impact

Run 33969819231 lost its macOS ARM64 hosted runner. Later attempts could not load a reusable workflow from the old snapshot; a fresh dispatch then failed because the requested old commit was not present locally. A separate retry correctly rejected a tag/source mismatch. This change makes available refs recoverable and gives actionable errors for unavailable refs and tag mismatches. The release guide explains when a fresh full run is needed after artifacts disappear.

Existing tag bindings, Apple signature verification, protected-main ancestry checks, and the requirement that all platforms succeed before Release publication remain enforced. Runner loss itself is an infrastructure failure, not a proven compiler defect; the original artifact deletion cause is still unknown.

Verification

• node --test scripts/release-channel.test.mjs: 9 passed, including real Git repository regressions for unadvertised commits, missing local branches, annotated tags, tag mismatch, and unavailable refs.
• pnpm run check:github-config: 13 YAML files parsed; 22 tests passed.
• node scripts/check-git-object-sizes.mjs --base origin/1.0.0-explore --head HEAD: passed.
• git diff --check: passed.

Reviewer Notes

AI-assisted; focused local checks passed. Native macOS/Windows package reruns are tracked separately in Actions. No product runtime behavior changed, and remote workspace/control/peer/dispatch scenarios were not exercised.

Checklist

• This PR is focused and excludes unrelated local documents and generated artifacts.
• Relevant verification is recorded above.
• Release recovery documentation is updated.