fix(release): exclude unpacked app from dev artifacts

Keep development desktop artifacts limited to distributable archives and update
metadata so macOS workflow downloads do not duplicate the packaged app bundle.
The package smoke step still validates the unpacked app before upload.

Tested: bun test scripts/pr/release-workflow.test.ts
Tested: bun run check:policy
Confidence: high
Scope-risk: narrow

.github/workflows/build-desktop-dev.yml

@@ -121,10 +121,10 @@ jobs:
         run: |
           STAGING="desktop/build-artifacts/ci-Claude-Code-Haha-v${{ steps.version.outputs.version }}-${{ matrix.artifact_name }}"
           mkdir -p "$STAGING"
-          find desktop/build-artifacts/electron -maxdepth 2 \
-            \( -type f \( -name "*.dmg" -o -name "*.exe" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.zip" -o -name "*.blockmap" -o -name "*.yml" \) \) -o \
-            \( -type d -name "*.app" \) | while read -r artifact; do
-              cp -R "$artifact" "$STAGING/"
+          find desktop/build-artifacts/electron -maxdepth 1 -type f \
+            \( -name "*.dmg" -o -name "*.exe" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.zip" -o -name "*.blockmap" -o -name "*.yml" \) \
+            | while read -r artifact; do
+              cp -f "$artifact" "$STAGING/"
             done
           echo "staging_dir=$STAGING" >> "$GITHUB_OUTPUT"
           ls -lh "$STAGING/" 2>/dev/null || true