ci: migrate desktop packaging to GitHub Actions and add changesets release flow (#1)

* ci: migrate desktop packaging pipeline to GitHub Actions

Replace the GitLab CI pipeline with a GitHub Actions workflow:

- .github/workflows/desktop-build.yml: workflow_dispatch trigger with
  sign-macos / retention-days inputs; matrix builds macOS arm64+x64,
  Windows x64 and Linux x64 on standard GitHub-hosted runners; checkout
  pulls the kimi-code submodule recursively; installers upload as
  kimi-desktop-<target> artifacts.
- .github/actions/macos-keychain-{setup,cleanup}: composite actions
  taken from the kimi-code repo (the previous GitLab shell scripts were
  themselves translated from these).
- Delete .gitlab-ci.yml; update AGENTS.md and apps/desktop/README.md;
  the scripts/ci/*.sh helpers are now only used by local packaging
  (package-local-macos.sh) and their headers say so.

* ci: temporarily trigger desktop-build on branch push for verification

workflow_dispatch requires the workflow file on the default branch;
before merge, run the pipeline on pushes to this branch (signed macOS
builds by default). Removed after verification.

* fix(desktop): unbreak Windows and Linux CI packaging

- Linux: electron-builder 26 validates executableName file-path safety;
  derive from package name fails (@moonshot-aikimi-desktop contains @).
  Set linux.executableName to kimi-code explicitly.
- Windows: @electron/rebuild 3.7.1 pins an old @electron/node-gyp fork
  that does not recognize Visual Studio 2026 (v18), the only toolchain
  on the windows-2025 image. Bump to 4.2.0, which uses plain
  node-gyp 12.4.0 with VS2026 support (and dedupes with
  electron-builder's own copy).

* ci: drop temporary branch push trigger from desktop-build

All four platforms verified green (macOS signed + notarized, Windows,
Linux). Back to workflow_dispatch-only as intended; the manual dispatch
becomes available once the workflow lands on the default branch.

* ci: add changesets-based desktop release flow

Mirror the kimi-code repo's changesets setup, but the publish step
produces desktop installers on a GitHub Release instead of npm:

- .changeset/: only @moonshot-ai/kimi-desktop is versioned; every other
  workspace package is ignored.
- release.yml (push to main): changesets/action maintains the
  'ci: release desktop' version PR; once it merges and the desktop
  version has no matching tag, the workflow calls desktop-build.yml
  (signed + notarized, four platforms), creates GitHub Release
  v<version> pinned to the merge commit, and uploads all installers
  as release assets. Idempotent: existing tag -> skip; the tag is only
  created alongside the release after a successful build, so reruns
  are safe.
- desktop-build.yml: restore the workflow_call trigger (same interface
  as the kimi-code repo) and switch the artifact prefix to
  kimi-code-app.

* refactor: rename desktop package to kimi-code-app, drop license fields

- apps/desktop: @moonshot-ai/kimi-desktop -> kimi-code-app (unscoped);
  homepage follows the repo name. The workflow artifact prefix already
  moved to kimi-code-app, so naming is now consistent end to end.
- Update every package-name reference (root scripts, desktop-build.yml,
  package-local-macos.sh, docs). Runtime identity strings are
  intentionally untouched: userAgentProduct 'kimi-desktop' (required
  upstream), storage keys, and [kimi-desktop] log prefixes.
- Remove the "license": "MIT" field from root / apps/web /
  apps/desktop package.json.

* refactor: rename web package to kimi-code-web

Follows the desktop rename: @moonshot-ai/kimi-web -> kimi-code-web
(unscoped). Updates every live reference (root scripts, sync script,
docs, test run hints, changesets ignore list). apps/web/CHANGELOG.md
keeps the historical name; the kimi-code submodule has no dependency
on this package name.

* chore: reset desktop version to 0.0.0

Fresh versioning baseline for the changesets flow — the first
'ci: release desktop' PR will produce the initial real version.

scripts/sync-web-to-kimi-code.mjs

@@ -27,7 +27,7 @@ async function assertBuiltWeb() {
     }
   } catch {
     throw new Error(
-      `未找到 web 构建产物 ${source}/index.html，请先运行 \`pnpm --filter @moonshot-ai/kimi-web run build\`。`,
+      `未找到 web 构建产物 ${source}/index.html，请先运行 \`pnpm --filter kimi-code-web run build\`。`,
     );
   }
 }