Add VarVik-owned desktop update channel

[Cvv9]

What changed

• derive desktop updater and release URLs from the publishing repository
• make web desktop downloads use the VarVik release channel in fork Docker builds
• preserve the existing in-app update card and inject the correct manual-release URL
• add fork-compatible Apple Developer ID signing/notarization for Intel and Apple Silicon packages
• add release readiness documentation and validation

Verified

• web check and unit tests
• VarVik-configured production web build
• desktop typecheck
• desktop test suite: 3910 passed
• release workflow actionlint/YAML parse
• shell syntax and git diff checks

Release gate

The workflow intentionally stops before publishing until the permanent Tauri updater key and VarVik Apple Developer credentials are configured. Windows Authenticode remains recommended before distribution beyond the pilot.