Release every program

Every release ships the hive CLI and Hive Desktop together, under one semver version tagged v<version> (ADR every-program-ships-under-one-shared-version). The run starts on this machine because the desktop's signing keys live here. mise loads release credentials automatically; never read .env, inspect secret values, or invoke the release CLI's publish command outside mise.

The run publishes the desktop first: it builds every platform here (macOS plus both Linux architectures, so it needs macOS and a running Docker together), uploads to R2, and writes the stable, beta, and dev manifests. It then pushes the v<version> tag and dispatches publish.yml, which builds the CLI with GoReleaser, creates the one GitHub release with every program's notes, publishes the Homebrew cask, and deploys the site. The run waits for the workflow. Step 9 covers recovering that last step.