fix(desktop): address Windows packaging review findings

.github/workflows/windows-package.yml

@@ -19,7 +19,7 @@ on:
         type: string
         required: true
       login_origins:
-        description: 'Test only: comma-separated allowed login HTTPS origins'
+        description: 'Required for test: comma-separated allowed login HTTPS origins'
         type: string
         required: false
 
@@ -39,8 +39,8 @@ jobs:
       - uses: actions/[email protected]
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@v5.0.0
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: '24'
       - name: Install locked dependencies
@@ -69,7 +69,7 @@ jobs:
           exit $LASTEXITCODE
       - name: Retain packaging diagnostics
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: windows-package-logs-${{ github.run_id }}-${{ github.run_attempt }}
           include-hidden-files: true
@@ -77,7 +77,7 @@ jobs:
           if-no-files-found: warn
           retention-days: 14
       - name: Retain verified installer
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: windows-x64-unsigned-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
           include-hidden-files: true