Phase C: package as an unsigned macOS .dmg (electron-builder)

Adds shareable desktop packaging so the app can be handed to teammates.

- electron-builder@25 + electron-builder.yml: appId io.stephenmann.commitea,
  productName CommiTea, icon from the logo (build/icon.png, 1024²), macOS dmg
  targets for arm64 + x64. Ships only out/** (electron-vite already bundles
  renderer/preload/main with core + react inlined), npmRebuild off,
  electronVersion pinned to 34.5.8 (workspace hoisting defeats auto-detect).
- Unsigned by decision: mac.identity null, hardenedRuntime off. electron-builder
  ad-hoc signs so arm64 runs; not notarized — teammates right-click → Open once.
- Scripts: `yarn pack` (--dir sanity build), `yarn dist` (both dmgs). package.json
  gains version/author/description (required by electron-builder).
- README.md: dev/build/package commands + the Gatekeeper install step.

Verified: packaged arm64 app boots from a fresh profile (lands on onboarding);
`yarn dist` produced CommiTea-0.1.0-arm64.dmg (98M) and CommiTea-0.1.0.dmg (x64,
102M), each mounting with a drag-to-Applications layout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/electron-builder.yml

@@ -0,0 +1,51 @@
+appId: io.stephenmann.commitea
+productName: CommiTea
+copyright: © CommiTea
+
+# Pinned because electron is hoisted by the yarn workspace and declared with a
+# caret range, which electron-builder can't resolve on its own. Keep in sync with
+# the electron devDependency.
+electronVersion: 34.5.8
+
+directories:
+  buildResources: build
+  output: dist
+
+# The renderer, preload, and main are already bundled into out/ by electron-vite
+# (@commitea/core, react, react-dom are all inlined). So the packaged app needs
+# nothing from node_modules except the Electron runtime that electron-builder
+# supplies — ship only the build output.
+files:
+  - out/**
+  - '!**/*.map'
+npmRebuild: false
+electronLanguages:
+  - en
+
+mac:
+  target:
+    - target: dmg
+      arch:
+        - arm64
+        - x64
+  category: public.app-category.developer-tools
+  icon: build/icon.png
+  # Unsigned, per the distribution decision (macOS, no certs). Teammates
+  # right-click → Open the first time to get past Gatekeeper.
+  identity: null
+  # Keep hardened-runtime off — it only matters for signed/notarized builds
+  # and can block an unsigned app from launching.
+  hardenedRuntime: false
+  gatekeeperAssess: false
+
+dmg:
+  title: CommiTea ${version}
+  # A plain drag-to-Applications layout.
+  contents:
+    - x: 130
+      y: 220
+      type: file
+    - x: 410
+      y: 220
+      type: link
+      path: /Applications