fix(desktop): reject debug publications early and harden runner supervision

.github/workflows/ci.yml

@@ -572,6 +572,15 @@ jobs:
       - name: Run blocking Windows builds
         shell: pwsh
         run: pnpm run check:ci:windows-blocking
+      - name: Parse Windows runner supervision scripts
+        shell: pwsh
+        run: |
+          foreach ($path in @('apps/desktop/scripts/windows-runner-task.ps1', 'apps/desktop/scripts/run-windows-runner-task.ps1', 'apps/desktop/tests/windows-runner-task.ps1')) {
+            $tokens = $null
+            $parseErrors = $null
+            $null = [Management.Automation.Language.Parser]::ParseFile((Join-Path $env:GITHUB_WORKSPACE $path), [ref]$tokens, [ref]$parseErrors)
+            if ($parseErrors.Count) { throw ($parseErrors -join "`n") }
+          }
       - name: Run Windows observational gates on built artifacts
         id: observational
         continue-on-error: true

.github/workflows/desktop-publish.yml

@@ -31,6 +31,11 @@ jobs:
       - uses: actions/[email protected]
         with:
           persist-credentials: false
+      - name: Reject debugging packages before dependency installation
+        id: preflight
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node apps/desktop/scripts/preflight-desktop-publish.mjs
       - uses: pnpm/[email protected]
       - uses: actions/[email protected]
         with:
@@ -41,6 +46,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           DESKTOP_PUBLISH_RUNNERS: ${{ vars.DESKTOP_PUBLISH_RUNNERS }}
+          DESKTOP_PACKAGE_ATTEMPT: ${{ steps.preflight.outputs.attempt }}
         run: node --import tsx apps/desktop/scripts/resolve-desktop-publish-ci.ts
 
   prepare:

.github/workflows/macos-package.yml

@@ -10,7 +10,7 @@ on:
         default: test
         required: true
       skip_notarization:
-        description: '跳过公证和 stapling：仅限内部调试，不可用于发布或自动更新'
+        description: '跳过公证和 stapling：仅限内部调试，禁止发布到 test / production 或用于自动更新；需要发布请勿勾选'
         type: boolean
         default: false
         required: true

.github/workflows/windows-package.yml

@@ -10,7 +10,7 @@ on:
         default: test
         required: true
       signing:
-        description: '签名方式：unsigned 仅供内部测试；signed 使用机器配置的 EV 硬件令牌'
+        description: '签名方式：unsigned 仅限内部调试，禁止发布到 test / production 或用于自动更新；需要发布请选择 signed（EV 硬件令牌）'
         type: choice
         options: [unsigned, signed]
         default: unsigned