ci: disable desktop release + e2e in CI for now

The desktop-release reusable-workflow call requested contents: write,
which ci.yml's permission grant (contents: read) rejects — invalidating
the whole CI workflow. Desktop is tested locally for now; signed builds
remain available manually via desktop-release.yml workflow_dispatch, and
desktop e2e via its own workflow_dispatch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

.github/workflows/ci.yml

@@ -531,15 +531,6 @@ jobs:
           GH_PAT: ${{ secrets.GITHUB_TOKEN }}
         run: bun run scripts/create-single-release.ts ${{ needs.detect-version.outputs.version }}
 
-  # Desktop macOS artifacts attach to the release created above. Ordering is
-  # load-bearing: create-single-release.ts skips creation when the tag already
-  # exists, so the desktop job must never run before create-release.
-  desktop-release:
-    name: Desktop Release
-    needs: [detect-version, create-release]
-    if: needs.detect-version.outputs.is_release == 'true'
-    uses: ./.github/workflows/desktop-release.yml
-    with:
-      version: ${{ needs.detect-version.outputs.version }}
-      publish: true
-    secrets: inherit
+  # Desktop release is disabled in CI for now (the app is tested locally).
+  # Signed macOS artifacts can still be built manually via the
+  # desktop-release.yml workflow_dispatch when needed.

.github/workflows/desktop-e2e.yml

@@ -3,12 +3,11 @@ name: Desktop E2E
 # Smoke coverage of the real Electron shell, plus an advisory canary leg
 # against electron@latest so Chromium-cadence breakage surfaces before an
 # upgrade is attempted (U18/U22).
+#
+# Manual-only for now: the desktop app is tested locally, so the
+# pull_request trigger is disabled until desktop CI is turned back on.
 
 on:
-  pull_request:
-    paths:
-      - 'apps/desktop/**'
-      - '.github/workflows/desktop-e2e.yml'
   workflow_dispatch:
 
 concurrency: