ci: derive Desktop Production from central admission

[abrichr]

Summary

• publish future engine and native outputs as unadmitted release candidates
• derive Desktop Production state only from the active signed OpenAdaptAI/.github admission
• verify exact version, tag, native source commit, Python artifacts, installer artifacts, and digests
• append an attested derived cache that binds both the current central commit and admission digest
• remove fixed Beta and Experimental wording from Desktop, Capture, tray, privacy, and runtime-facing metadata

Production authority

OpenAdaptAI/.github remains the only authority. A normal release never writes the Production cache. The new workflow checks out one exact current central commit, runs its canonical validator, and selects its active latest Desktop admission. It reports no Production default when that admission is absent, inactive, expired, or revoked.

The manual promote operation runs only in the protected production-release environment. It rechecks current Desktop and central main, revalidates the unchanged candidate, writes one append-only cache descriptor, attests the exact bytes, and downloads and verifies the published copy. A failed check leaves all prior cache assets unchanged. There is no fallback to PyPI latest, GitHub Latest, or an older admission.

Why this PR is draft

The current canonical ledger at d60445bc8617adc4a27c20e6ce05681a95d83a2c has no active Desktop admission. The workflow therefore refuses promotion today. Keep this PR draft until the real candidate and central admission exercise the complete path.

Before this becomes ready:

1. Publish the exact release candidate after the existing Flow and signing release holds clear.
2. Add its evidence-backed Desktop admission to the canonical central ledger.
3. Protect the Desktop production-release environment on main, with no admin bypass.
4. Dispatch production-channel.yml with the exact current central commit.
5. Verify the appended cache attestation and the scheduled current-default drift check.

Validation

• uv run pytest -q — 1,048 passed, 3 dependency deprecation warnings
• focused release, metadata, and runner tests — 155 passed
• Ruff — passed
• actionlint — passed
• release consistency — passed
• source-boundary check — passed
• exact base f0f5d140698ff91ccabd391a835463afe9370e06 — Test, Build artifacts, CodeQL, Dependency Audit, Secret Scan, and Release health passed