Build each platform on its own native runner

Splits the release workflow into linux, windows and macos jobs feeding a
single publish job. The publish step is separate so parallel builds cannot
race to create the release and fail on a duplicate tag.

Windows now builds natively, so signAndEditExecutable no longer has to be
disabled. That flag was suppressing rcedit, which is what embeds the icon
and version resources -- the v1.0.0 exe shipped with the stock Electron
icon as a result. Also adds an NSIS installer alongside the portable zip.

macOS gains a dmg target, which cannot be produced off macOS. Builds stay
unsigned pending a Developer ID, with CSC_IDENTITY_AUTO_DISCOVERY disabled
so electron-builder builds unsigned instead of failing on a real Mac.

Nothing cross-builds now; all three runners must be registered before
tagging, since a job with no matching runner queues silently.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

desktop-client/package.json

@@ -25,10 +25,11 @@
       "main": "index.js"
     },
     "win": {
-      "target": "zip",
-      "sign": false,
-      "signAndEditExecutable": false,
-      "certificateSubjectName": null
+      "target": [
+        "nsis",
+        "zip"
+      ],
+      "icon": "build/icon.png"
     },
     "linux": {
       "target": [
@@ -42,10 +43,17 @@
     "artifactName": "${productName}-${version}-${os}-${arch}.${ext}",
     "mac": {
       "target": [
+        "dmg",
         "zip"
       ],
       "icon": "build/icon.png",
-      "category": "public.app-category.music"
+      "category": "public.app-category.music",
+      "identity": null
+    },
+    "nsis": {
+      "oneClick": false,
+      "allowToChangeInstallationDirectory": true,
+      "perMachine": false
     }
   },
   "dependencies": {