fix(desktop): pin the latest published deployment on first install

[davidmckayv]

What this changes

Fresh desktop installs currently download v0.0.8 even after a newer deployment is published. Resolve GitHub's latest published release on first setup, then use its exact tag for both the source archive and image manifest. Record that version only after the download succeeds; subsequent starts and repairs retain the installed pin without querying GitHub.

Both Start and provider sign-in use this path. Release discovery and downloading run on a blocking task, with failures reported in the setup UI.

Release dependency: GitHub's latest release is still v0.0.8 as of September 11. This PR removes the fixed selection; a newer deployment containing S5's provider sign-in images still needs to be published. It does not upgrade existing installations or establish that v0.0.8 supports provider sign-in.

Where it runs

Desktop only. The selected tag lives in the existing .openbot-deployment file. No new server state, replica coordination, serialization mechanism, browser fanout, listeners, ports, or schedules.

Boundary and audit

The existing gateway and server audit paths are unchanged. Release discovery uses GitHub's public API without credentials; setup failures use the existing deployment error reporting.

Changelog

Added an entry under Unreleased.

Proof

• 29 focused Rust deployment tests passed, plus the desktop deployment-ready and provider sign-in boundary checks.
• Ran the opt-in live test against GitHub: production code downloaded v0.0.8 into an empty temporary directory, verified the source/package version, manifest version, required deployment files, saved pin, and subsequent reuse without a GitHub lookup.
• cargo fmt --check, cargo clippy --all-targets -- -D warnings, and the Rust desktop binary build passed on macOS.
• No GUI or provider OAuth validation is claimed by this change. The existing desktop CI will test and package all three platforms.

Reproduce the live download from desktop/src-tauri:

cargo test --lib deployment_release::tests::live_latest_release_is_downloaded_and_pinned -- --ignored --exact --nocapture

The endpoint's stable-release and public-access behavior was checked against GitHub's documentation.