Purge fork-unrunnable workflows, add desktop artifact builds on main

[jmclaren7]

What Changed

Reduced this fork's workflow set to what can actually run here, and added a build that produces desktop binaries on every push to main.

Kept (2):

Workflow	Why it stays
ci.yml	Already fork-adapted (standard runners, mobile job dropped).
issue-labels.yml	GITHUB_TOKEN only; bootstraps the labels .github/ISSUE_TEMPLATE/*.yml apply. Verified the labels API answers for this repo.

Added: desktop-artifacts.yml — builds the same four platforms upstream's release matrix covers (macOS arm64/x64 DMG, Linux x64 AppImage, Windows x64 NSIS) on every push to main and on manual dispatch. Builds are unsigned and uploaded as workflow artifacts (14-day retention); nothing is published. It reuses upstream's build job minus everything credentialed, keeping the two secret-free pieces that matter: the Linux node-pty prebuild bundled into the Windows artifact (non-fatal when missing, so a prebuild failure degrades that artifact instead of failing it) and the Spectre-mitigated MSVC libs install. --signed is never passed, which is what keeps scripts/build-desktop-artifact.ts off the signing paths and makes CSC_IDENTITY_AUTO_DISCOVERY=false.

Deleted — needs credentials and/or Blacksmith runners:

• release.yml (Cloudflare + Clerk + Apple + Azure + npm OIDC + release GitHub App)
• deploy-relay.yml (Cloudflare, PlanetScale, Axiom, Clerk, APNs; fired on every push to main)
• mobile-eas-preview.yml, mobile-eas-production.yml (EXPO_TOKEN)
• mobile-showcase-screenshots.yml (Blacksmith macOS/Linux runners)

Deleted — upstream community governance, no value in a fork whose PRs are all authored by the owner and its agents (both on pull_request_target):

• pr-vouch.yml + .github/VOUCHED.td — trust-gates external contributors against upstream's contributor list
• pr-size.yml — size labels; its sync-label-definitions job was dead code besides (if: github.event_name != 'pull_request_target' on a workflow whose only trigger is pull_request_target)

Why

Every workflow here now has to clear two bars: standard GitHub-hosted runners, and no credentials beyond the automatic GITHUB_TOKEN.

The old set cleared neither. The fork's run history is the evidence: 30+ consecutive scheduled Release runs cancelled after the 24h queue timeout (every 3 hours, forever) because blacksmith-* labels never resolve in this fork, and the single push-triggered CI run on record went the same way before the runner swap landed. deploy-relay.yml fired on every push to main for a relay this fork does not deploy. None of it could ever go green, so it is deleted rather than disabled — a disabled workflow silently comes back on the next rebase.

What was missing in exchange was the one thing a dev fork actually wants from CI: binaries. desktop-artifacts.yml fills that gap on the trigger requested — whenever main updates.

Two follow-on edits that are part of the same change rather than scope creep:

• Dropping release.yml stranded the release workflow tracing config propagation guard in infra/relay/scripts/deploy.test.ts, which read that file off disk and would have failed vp run test. Removed, with a note on restoring it alongside the workflow.
• Docs describing the deleted workflows (docs/operations/ci.md, release.md, mobile-app-store-screenshots.md, infra/relay/README.md) get fork notes instead of deletion — they stay useful as upstream reference on rebases. CONTRIBUTING.md lost its now-false vouch:* / size:* paragraph, and FORK.md section F records the standing rule so a rebase does not silently reintroduce a workflow that cannot run here.

UI Changes

Not applicable.

Checklist

• This PR is small and focused — one concern (the fork's workflow set); the line count is mostly the ~2k deleted lines of upstream workflow YAML
• I explained what changed and why
• I included before/after screenshots for any UI changes — no UI changes
• I included a video for animation/interaction changes — not applicable

Verification

• All three remaining workflows pass actionlint with shellcheck enabled (exit 0).
• Flags used by the new build step were checked against scripts/build-desktop-artifact.ts (--platform, --target, --arch, --wsl-prebuild, --verbose); build version is omitted so it falls back to serverPackageJson.version, as local dist:desktop:artifact runs do.
• macOS x64 cross-builds from the arm64 runner the same way upstream does — the staged workspace pins pnpm supportedArchitectures for the target arch.
• CI on this PR is the real check for the deploy.test.ts edit.
• The build matrix itself first runs on merge, since workflow_dispatch needs the file on the default branch. Worth watching that first run.

---

Generated by Claude Code