ci(desktop): guard the installers and version-pin release notes

[VickyXAI]

Two gaps in desktop-ci.yml's release job, found reviewing #146 while cutting desktop-v0.2.0-beta.2.

Worth noting up front: #146's own fix is verified working. Its first-ever production run was beta.2, and the CI-generated SHA256SUMS.txt hashes match GitHub's asset digests exactly, with filenames matching the uploaded assets (Franklin.Setup.0.2.0-beta.2.exe). This PR addresses what that code does not cover.

Nothing checked that both installers arrived

download-artifact does not fail when its pattern matches no artifacts, so a partial download would publish a release with one installer plus a SHA256SUMS.txt that looks complete — the checksum step succeeds either way. Adds an explicit count check for exactly one .dmg and one .exe before anything is hashed or uploaded.

Release notes were destroyed by re-runs

The body was a hardcoded two-sentence blurb in the workflow. action-gh-release updates an existing release, so notes written by hand on the release page were silently replaced the moment the job was re-run. And since every release got the same two sentences, both beta.1 and beta.2 had to be hand-edited afterward.

The body now comes from apps/desktop/release-notes/<version>.md, checked in with the version bump:

• Re-running a release reproduces the same body instead of clobbering it.
• The filename carries the version, so notes cannot go stale against a newer tag — a common failure with a single RELEASE_NOTES.md.
• A tag with no matching file falls back to the original blurb rather than failing, so re-running tags that predate this change still works.

actions/checkout is added ahead of the download step, not after: it cleans the workspace by default and would otherwise delete the installers.

beta.2's published notes are checked in as the first file, so a re-run of that tag now reproduces what is live.

Verification

Both run: scripts were extracted exactly as Actions de-indents the YAML block scalars, then executed:

• notes step, no notes file → falls back to the blurb, name=Franklin Desktop 0.9.9
• notes step, notes file present → copies it, name=Franklin Desktop 0.2.0-beta.3
• guard, one dmg + one exe → passes
• guard, dmg only / exe only / empty dir → exits 1 in all three

Not addressed

softprops/action-gh-release@v2 is a floating major tag on a job holding contents: write, so its code changes without review. (Checked: the Node 20 deprecation does not apply — v2's action.yml currently declares using: "node24". v3.0.3 exists if you want to pin deliberately.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01EdbfY8FiReoKH32UKeKfzN