Phase C: package as an unsigned macOS .dmg (electron-builder)

Adds shareable desktop packaging so the app can be handed to teammates.

- electron-builder@25 + electron-builder.yml: appId io.stephenmann.commitea,
  productName CommiTea, icon from the logo (build/icon.png, 1024²), macOS dmg
  targets for arm64 + x64. Ships only out/** (electron-vite already bundles
  renderer/preload/main with core + react inlined), npmRebuild off,
  electronVersion pinned to 34.5.8 (workspace hoisting defeats auto-detect).
- Unsigned by decision: mac.identity null, hardenedRuntime off. electron-builder
  ad-hoc signs so arm64 runs; not notarized — teammates right-click → Open once.
- Scripts: `yarn pack` (--dir sanity build), `yarn dist` (both dmgs). package.json
  gains version/author/description (required by electron-builder).
- README.md: dev/build/package commands + the Gatekeeper install step.

Verified: packaged arm64 app boots from a fresh profile (lands on onboarding);
`yarn dist` produced CommiTea-0.1.0-arm64.dmg (98M) and CommiTea-0.1.0.dmg (x64,
102M), each mounting with a drag-to-Applications layout.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/README.md

@@ -0,0 +1,42 @@
+# CommiTea (desktop)
+
+An AI project manager for Gitea, as an Electron desktop app. The token stays in
+the main process (OS keychain via `safeStorage`); the renderer never sees it.
+
+## Develop
+
+```bash
+yarn dev          # electron-vite dev, HMR renderer + main (logs → desktop.log)
+yarn typecheck
+yarn e2e          # builds, then Playwright against the built main (fixtures/demo)
+```
+
+For a live pass against a real Gitea, put a token in `.env.local`
+(`GITEA_TOKEN=…`) and run `GITEA_LIVE=1 yarn e2e live-onboarding`.
+
+## Package (shareable macOS .dmg)
+
+```bash
+yarn pack         # unpacked .app for the host arch (fast sanity check) → dist/
+yarn dist         # arm64 + x64 .dmg → dist/CommiTea-<version>[-arm64].dmg
+```
+
+Config is `electron-builder.yml`. Builds are **unsigned** (no Apple certs, by
+decision) — electron-builder ad-hoc signs so the app can run, but it is not
+notarized. Bump `version` in `package.json` for a new release; keep
+`electronVersion` in `electron-builder.yml` in sync with the `electron`
+devDependency.
+
+### Installing a shared build (teammates)
+
+macOS Gatekeeper blocks unsigned apps on first launch. To open:
+
+1. Open the `.dmg` and drag **CommiTea** to **Applications**.
+2. In Applications, **right-click CommiTea → Open**, then confirm **Open** in the
+   dialog. (Double-clicking the first time just shows "cannot be opened".)
+3. It opens to the connection screen — enter your Gitea base URL, `owner/repo`,
+   and a personal access token (repo scope). Each teammate uses their own token,
+   so activity is attributed correctly. A model URL is optional; chat is disabled
+   until one is configured, everything else works without it.
+
+Grab the `-arm64` dmg on Apple Silicon, the plain one on Intel.

apps/desktop/electron-builder.yml

@@ -0,0 +1,51 @@
+appId: io.stephenmann.commitea
+productName: CommiTea
+copyright: © CommiTea
+
+# Pinned because electron is hoisted by the yarn workspace and declared with a
+# caret range, which electron-builder can't resolve on its own. Keep in sync with
+# the electron devDependency.
+electronVersion: 34.5.8
+
+directories:
+  buildResources: build
+  output: dist
+
+# The renderer, preload, and main are already bundled into out/ by electron-vite
+# (@commitea/core, react, react-dom are all inlined). So the packaged app needs
+# nothing from node_modules except the Electron runtime that electron-builder
+# supplies — ship only the build output.
+files:
+  - out/**
+  - '!**/*.map'
+npmRebuild: false
+electronLanguages:
+  - en
+
+mac:
+  target:
+    - target: dmg
+      arch:
+        - arm64
+        - x64
+  category: public.app-category.developer-tools
+  icon: build/icon.png
+  # Unsigned, per the distribution decision (macOS, no certs). Teammates
+  # right-click → Open the first time to get past Gatekeeper.
+  identity: null
+  # Keep hardened-runtime off — it only matters for signed/notarized builds
+  # and can block an unsigned app from launching.
+  hardenedRuntime: false
+  gatekeeperAssess: false
+
+dmg:
+  title: CommiTea ${version}
+  # A plain drag-to-Applications layout.
+  contents:
+    - x: 130
+      y: 220
+      type: file
+    - x: 410
+      y: 220
+      type: link
+      path: /Applications

apps/desktop/package.json

@@ -1,5 +1,8 @@
 {
   "name": "@commitea/desktop",
+  "version": "0.1.0",
+  "description": "CommiTea — an AI project manager for Gitea",
+  "author": "CommiTea",
   "private": true,
   "type": "module",
   "main": "./out/main/index.js",
@@ -10,7 +13,9 @@
     "typecheck": "tsc --noEmit",
     "e2e": "electron-vite build && playwright test",
     "e2e:only": "playwright test",
-    "e2e:report": "playwright show-report e2e/.artifacts/report"
+    "e2e:report": "playwright show-report e2e/.artifacts/report",
+    "pack": "electron-vite build && electron-builder --dir",
+    "dist": "electron-vite build && electron-builder --mac"
   },
   "dependencies": {
     "@commitea/core": "workspace:*",
@@ -25,6 +30,7 @@
     "@vitejs/plugin-react": "^4.3.4",
     "autoprefixer": "^10.4.20",
     "electron": "^34.0.0",
+    "electron-builder": "^25",
     "electron-vite": "^3.1.0",
     "postcss": "^8.5.1",
     "tailwindcss": "^3.4.17",