fix(ci): parse Windows release reports safely

[pallyoung]

What changed

• parse Windows-generated JSON acceptance reports with optional UTF-8 BOM in Desktop and CLI promotion gates
• pass the repository explicitly to gh release download in the checkout-free Desktop promotion job
• add workflow boundary assertions for both release safeguards

Root cause

Production Windows reports are UTF-8 JSON with a BOM. Both promotion workflows used bare JSON.parse(readFileSync(...)), so otherwise-valid reports failed before identity validation. Desktop promotion also called gh release download from a job without checkout or --repo, causing gh to fail while resolving the repository.

Release impact

• desktop-v0.1.1 assets and native/WSL production acceptance passed and were promoted only after the same report identity validation was reproduced successfully
• npm latest remains 0.5.6; v0.5.8 has not been created
• after this fix is merged, CLI 0.5.8 promotion can validate the accepted Desktop reports and finish safely

Validation

• workflow boundary test: 5/5 passed
• pnpm ci:typecheck: passed
• pnpm changeset:validate: passed
• git diff --check: passed