fix(desktop): Windows, macOS and Linux release builds, PR coverage for them, release 0.21.1

[abrichr]

This prepares Desktop 0.21.1. Merging it starts that release, so the founder approves the merge. 0.21.0 (39112b7) was never published: main's desktop matrix failed on it (Packages run 39306955258), and the release gate requires that matrix to pass. The 0.21.1 changelog section says so.

Fixes

1. Windows engine tests (job 118266645919): Git on Windows checks files out with CRLF, and the Cargo.toml and Cargo.lock version patterns in native_release.set_native_version required LF. So prepare_release.py raised "could not rewrite package version". The patterns now accept CRLF and keep each line's ending. A new test, test_prepare_works_on_a_crlf_checkout, converts every version file to CRLF, so the Linux lane catches this too. It fails without the fix.
2. macOS sidecar and installers (jobs 118267947313, 118267947454): the lock had moved to pyobjc-core 12.2.2 and added pyobjc-framework-CoreMedia and -ScreenCaptureKit 12.2.2. None of these wheels ships a license file, and the reviewed records covered only 12.2.1. Three records now cover them; the check itself is unchanged.
   • License text: upstream's License.txt for all three at tag v12.2.2 (commit 38cdf73fc049ef2d176973eff4ac8d5c76b0a34b) is byte-identical to the vendored third_party/pyobjc/LICENSE.txt (MIT, SHA-256 0ca04b07…).
   • What each record pins: the source URL, the commit, the text hash, and the hash of the wheel's license metadata (MIT), as for 12.2.1.
   • README: third_party/README.md lists the new versions.
   • Local check: on this Mac, every installed distribution in the Desktop environment now has a notice source.
3. Linux installer (job 118267947408): the real error isn't the apt retries. tauri-plugin-deep-link 2.6.2 builds rust-ini's ParseOption without the two fields rust-ini 0.21.3 added, so it doesn't compile on Linux. I took 2.6.2 in build(desktop): bump Tauri on the npm and cargo sides together; Dependabot leaves paired pins alone #1324, together with tauri-plugin-single-instance 2.5.4, which requires it.
   • Fix: both go back to the versions main built before (2.6.1 and 2.5.3). No npm package pairs with either.
   • Dependabot: the note in dependabot.yml now says to build the Linux installer before taking a Tauri plugin bump.

So this can't hide again

These jobs ran only on main. Now a pull request that touches Desktop also runs:

• the Python engine tests on Windows (Python 3.12), next to the two Linux lanes;
• the frozen sidecar build on macOS 14, which checks the PyObjC notices;
• the Linux installer, when it changes src-tauri/, package.json or package-lock.json. This would have caught the deep-link failure.

The native-installer matrix is now built by the artifact-scope job: all four platforms on main and dispatch, and Linux only on a pull request. classify_build_changes.py takes a PR's changed paths from the merge commit's first parent. Its tests cover the new rule.

This PR changes src-tauri/Cargo.lock, so its own CI should run the Windows tests, the macOS sidecar and the Linux installer.

Tests

• Local, on macOS: 145 passed across the release-intent, build-classifier, native-release, frozen-notice and metadata tests. ruff passes on the changed files.
• The release-intent and version-consistency checks pass.
• actionlint is clean on both workflows, and the scope step's matrix output was checked for PR and dispatch.
• The name guard and gitleaks found nothing.
• Not run locally: the Windows tests, the macOS sidecar and the Rust builds. This PR's CI runs them.

🤖 Generated with Claude Code