fix(ci): refresh Codemagic workflow contract digests

codemagic.yaml on main drifted from the approved fixture digests, so Hygiene
failed on every PR. Refresh the entire-document and workflow semantic digests
to match the current checked-in Codemagic document.

Failure-Class: none

Author: undivisible

.github/scripts/fixtures/codemagic_workflow_contract/v1.json

@@ -1,13 +1,13 @@
 {
   "schema_version": 1,
-  "codemagic_raw_sha256": "207af8ed58acc6128a8e0137b7d4e91e69717cbae98e7e04709980646e83e67f",
-  "codemagic_semantic_sha256": "044b8997304bc15bea2fc00eac287890bb122776e1c4e7da0c954dd1c29321e5",
+  "codemagic_raw_sha256": "aada6da09e15bd7356d784ddb5f3be67cd17f17d0d84721b3de5c681cf7584ee",
+  "codemagic_semantic_sha256": "dd8a938be6ed34f9606191f92b96017096331e10c3f2cb3428989cdbd4713538",
   "omi-desktop-swift-preview": {
-    "semantic_sha256": "bc242475af6533f2bfd1aafb9c498e7fb1f42f00b37a992cf35f49f7f710c1aa"
+    "semantic_sha256": "1e5e4ceb67a9fc784761030d7254eb2d91dc973270b793b4513d74e3ec3063ce"
   },
   "omi-desktop-swift-release": {
     "publication_script": "if [[ \"${PREVIEW_MODE:-false}\" == \"true\" ]]; then\n  echo \"External previews do not create GitHub releases.\"\n  exit 0\nfi\nset -euo pipefail\nCHANGELOG_MD=$(python3 ../../.github/scripts/desktop-changelog.py latest-release --format markdown || echo \"- Bug fixes and improvements\")\n\n# Build changelog as pipe-separated string for KEY_VALUE_START\nCHANGELOG_PIPE=$(echo \"$CHANGELOG_MD\" | sed 's/^- //' | tr '\\n' '|' | sed 's/|$//')\n\nRELEASE_NOTES=\"## OMI Desktop v${VERSION}\n\n### What's New\n${CHANGELOG_MD}\n\n### Downloads\n- **DMG Installer**: For fresh installs, download the DMG below\n- **Auto-Update**: Existing users will receive this update automatically via Sparkle\n\n<!-- KEY_VALUE_START\nisLive: false\nchannel: candidate\nedSignature: ${ED_SIGNATURE}\nchangelog: ${CHANGELOG_PIPE}\nKEY_VALUE_END -->\"\n\n# A candidate is the evidence container. Once published, preserve its\n# signed artifacts and every qualification observation; retries only\n# resume the dispatch handoff below.\nif gh release view \"$CM_TAG\" --repo \"$GITHUB_REPO\" >/dev/null 2>&1; then\n  echo \"GitHub release candidate already exists; preserving immutable evidence for $CM_TAG\"\nelse\n  # The backend reservation is the authoritative Beta fence. It runs\n  # only after package, signature, notarization, and signed smoke pass,\n  # immediately before this workflow creates the immutable candidate.\n  set -euo pipefail\n  test -n \"${BETA_PROMOTION_TOKEN:-}\" || {\n    echo \"ERROR: BETA_PROMOTION_TOKEN is required to reserve a canonical candidate\" >&2\n    exit 1\n  }\n  curl --fail-with-body --silent --show-error \\\n    --request POST \"${OMI_PYTHON_API_URL%/}/v2/desktop/beta/candidates/reserve\" \\\n    --header \"Authorization: Bearer ${BETA_PROMOTION_TOKEN}\" \\\n    --header 'Content-Type: application/json' \\\n    --data \"{\\\"tag\\\":\\\"${CM_TAG}\\\"}\"\n  gh release create \"$CM_TAG\" \\\n    --repo \"$GITHUB_REPO\" \\\n    --title \"Omi Desktop v${VERSION} (candidate)\" \\\n    --notes \"$RELEASE_NOTES\" \\\n    \"$SPARKLE_ZIP_PATH\" \\\n    \"$DMG_PATH\" \\\n    \"$BUILD_DIR/desktop-smoke-result.json\"\n  echo \"GitHub release candidate created: $CM_TAG\"\nfi\n",
     "publication_script_sha256": "a8dfe376273b076fab7164ad84e48a3fab759ff97f4979ec8658629c8c837b40",
-    "semantic_sha256": "0c88165a0485640dc4804f65d34ad5d67d7ffcb62eb2c169a577f8d177ba590a"
+    "semantic_sha256": "06db30e0de2cbb1373ec66dd6180d2817cbb8afebccd99e09573cabcddf2bd42"
   }
 }