fix(desktop): force reliable full installer updates

[pallyoung]

What changed

• force legacy Desktop updaters to fall back to the complete installer by publishing a release-specific incompatible blockmap version
• disable NSIS differential and web-installer downloads in the new Desktop Shell
• cancel Shell downloads after five minutes without progress
• fail installed-upgrade acceptance after ten minutes so diagnostics are preserved

Why

The 0.1.1 to 0.1.2 acceptance matrix downloaded both blockmaps and then remained in downloading until the 90-minute job timeout. The old 0.1.1 process controls this upgrade, so a setting added only to 0.1.2 cannot affect that first hop. The release-side blockmap marker triggers electron-updater's existing full-download fallback; the complete installer remains protected by the SHA-512 in latest.yml.

Impact

Desktop 0.1.1 can upgrade to 0.1.2 through a reliable complete-installer download. Desktop 0.1.2 and later no longer use the unstable GitHub Release Range-download path. Downloads are larger, but stalled downloads now terminate with an actionable error.

Validation

• targeted script/workflow/acceptance tests: 18 passed
• Desktop update-manager tests: 5 passed
• pnpm ci:typecheck: passed
• pnpm changeset:validate: passed with 0 pending changesets
• targeted Biome check: passed
• real 0.1.2 release blockmap transformed and confirmed incompatible with 0.1.1

Full local pnpm ci:lint remains blocked by the repository-wide Windows CRLF checkout issue; GitHub's Linux CI is the release gate.