ci: cut over desktop releases to Electron

Repackages Electron app for legacy Tauri updater migration
Stops release and manual DMG workflows from building Tauri
Documents transition flow and cleanup timing

docs/TAURI_TO_ELECTRON_CUTOVER.md

@@ -4,6 +4,13 @@
 > designed will not be around when the cutover happens — read this file top to
 > bottom and execute; do not assume prior context.
 
+> Current status: the release workflow cutover is implemented. Desktop releases
+> now build Electron and repackage that Electron `.app` into the old Tauri
+> updater format for existing Tauri installs. The next safe engineering step is
+> [Step 5 — Remove Tauri-specific code](#step-5--remove-tauri-specific-code),
+> but only after the transition release has shipped and lived for at least 2
+> weeks with no rollback.
+
 ## What this is
 
 OpenChamber historically shipped as a Tauri app. A parallel Electron shell was
@@ -72,11 +79,46 @@ Check all of these before making any release:
 5. **`minisign` CLI is available on the macOS runner** (or installable via
    brew). Used to sign the Electron tarball with the Tauri key.
 
-## Release workflow changes
+## Current release workflow
 
-The file to edit: `.github/workflows/release.yml`.
+The release workflow no longer builds a Tauri desktop app. It now does this:
 
-Today it has these jobs (simplified):
+```text
+create-release
+├── build-desktop-electron-macos        (Electron .dmg/.zip/blockmap/latest-mac.yml)
+├── repackage-electron-as-tauri-update  (Electron .app -> Tauri .app.tar.gz/.sig)
+├── publish-npm
+├── combine-manifests                   (Tauri latest.json for migration only)
+├── combine-electron-manifests          (Electron latest-mac.yml)
+└── finalize-release
+```
+
+The transition works like this:
+
+1. `build-desktop-electron-macos` builds, signs, and notarizes the Electron app.
+2. It uploads the signed `OpenChamber.app` as a short-lived Actions artifact.
+3. `repackage-electron-as-tauri-update` downloads that Electron `.app`.
+4. It packs it into `OpenChamber-<version>-darwin-*.app.tar.gz`.
+5. It signs that tarball with the existing Tauri minisign private key.
+6. It uploads the tarball and `.sig` to the GitHub release.
+7. It generates Tauri-compatible manifests and `combine-manifests` merges them into `latest.json`.
+
+So old Tauri installs still see the update contract they expect:
+
+```text
+latest.json -> .app.tar.gz -> .sig
+```
+
+But the payload inside the `.app.tar.gz` is Electron, not Tauri. Tauri's updater
+only verifies the signature and extracts the bundle over the existing
+`/Applications/OpenChamber.app`. After restart, the app is Electron and future
+updates use `latest-mac.yml` through `electron-updater`.
+
+## Historical release workflow changes
+
+The file edited for the cutover was `.github/workflows/release.yml`.
+
+Before the cutover it had these jobs (simplified):
 
 ```
 create-release
@@ -90,6 +132,8 @@ create-release
 
 ### Step 1 — Remove the Tauri build
 
+Status: done.
+
 Delete these jobs entirely:
 - `build-desktop-macos`
 - `combine-manifests`
@@ -99,6 +143,8 @@ list must be updated to drop both.
 
 ### Step 2 — Add a repackage job
 
+Status: done.
+
 Insert after `build-desktop-electron-macos`:
 
 ```yaml
@@ -201,6 +247,8 @@ repackage-electron-as-tauri-update:
 
 ### Step 3 — Re-add the `combine-manifests` job
 
+Status: done.
+
 Bring it back (it was deleted in Step 1) but sourcing artifacts from the
 repackage job instead of the old Tauri build. The merging logic is identical
 to what the old job did. Minimum job shape:
@@ -232,6 +280,8 @@ combine-manifests:
 
 ### Step 4 — Update `finalize-release.needs`
 
+Status: done.
+
 ```yaml
 finalize-release:
   needs: [create-release, build-desktop-electron-macos, repackage-electron-as-tauri-update, publish-npm, combine-manifests, combine-electron-manifests]
@@ -239,8 +289,11 @@ finalize-release:
 
 ### Step 5 — Remove Tauri-specific code
 
-After the transition release ships and has been out at least 2 weeks with no
-rollback, remove:
+Status: next safe refactoring step, after the transition release ships and has
+been out at least 2 weeks with no rollback.
+
+Do not do this in the same release as the migration. Once the transition release
+has proved stable, remove:
 
 - `packages/desktop/` (entire package — Tauri Rust + UI glue)
 - Any `isTauriShell()` branches that are now dead code in
@@ -249,9 +302,13 @@ rollback, remove:
   audit each before removing).
 - This file (`docs/TAURI_TO_ELECTRON_CUTOVER.md`) — mission accomplished.
 
-Do this in a separate PR. Keep the transition release workflow intact until
-the cleanup lands; rolling the cleanup into the transition release itself
-makes debugging much harder if the migration misbehaves for a user.
+Do this in a separate PR. Keep the transition release workflow intact until the
+cleanup lands; rolling the cleanup into the transition release itself makes
+debugging much harder if the migration misbehaves for a user.
+
+The manual arm64 macOS DMG workflow has already been changed to build Electron
+only, so there should be no GitHub Actions path that accidentally produces a new
+Tauri DMG.
 
 ## Validation before tagging the transition release