fix(desktop): pass --publish never to the Linux packaging build (#10559)

electron-builder.config.mjs declares a `publish` block (GitHub provider), so
electron-builder auto-publishes whenever it detects CI. The config comment
spells out the resulting invariant: every build command must pass
`--publish never`. `build:linux`, added with Linux support in #10096, did
not — so the "Linux package · helper smoke" job of Desktop Windows CI has
failed on every commit since d660a1a with:

  Error: GitHub Personal Access Token is not set, neither programmatically,
  nor using env "GH_TOKEN"

That job is a required check on every PR touching desktop/windows/**, so
main has been red and the lane blocking since 2026-07-25 01:23 UTC.

Add the flag to build:linux (build:mac had the same latent gap; no CI lane
runs it, but the invariant is the same) and add a guard test so a platform
build script cannot ship without it again. No release lane calls build:linux
or build:mac — the Windows release workflow invokes electron-builder
directly and already passes --publish never.

Failure-Class: none

Verified: pnpm vitest scripts/build-scripts-publish.test.mjs 4/4 pass; with
the flag reverted on build:linux the guard fails exactly on that script
(1 failed | 3 passed). prettier --check clean. End-to-end proof is the
Linux package job on this PR, which runs the identical `pnpm run build:linux`
command that is failing on main.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: kodjima33

desktop/windows/package.json

@@ -32,8 +32,8 @@
     "vad:assets": "node scripts/copy-vad-assets.mjs",
     "build:unpack": "npm run build && electron-builder --dir --config electron-builder.config.mjs",
     "build:win": "npm run build && electron-builder --win --x64 --config electron-builder.config.mjs --publish never",
-    "build:mac": "electron-vite build && node scripts/bundle-pimono-extension.mjs && electron-builder --mac --config electron-builder.config.mjs",
-    "build:linux": "electron-vite build && node scripts/bundle-pimono-extension.mjs && electron-builder --linux --config electron-builder.config.mjs",
+    "build:mac": "electron-vite build && node scripts/bundle-pimono-extension.mjs && electron-builder --mac --config electron-builder.config.mjs --publish never",
+    "build:linux": "electron-vite build && node scripts/bundle-pimono-extension.mjs && electron-builder --linux --config electron-builder.config.mjs --publish never",
     "test": "vitest run",
     "test:watch": "vitest",
     "fixtures:audio": "node scripts/gen-audio-fixtures.mjs",

desktop/windows/scripts/build-scripts-publish.test.mjs

@@ -0,0 +1,30 @@
+import { readFileSync } from 'fs'
+import { resolve } from 'path'
+import { describe, it, expect } from 'vitest'
+
+// electron-builder.config.mjs declares a `publish` block (GitHub provider), so
+// electron-builder auto-publishes whenever it detects CI — and then dies with
+// "GitHub Personal Access Token is not set" in lanes that have no token.
+// `build:linux` shipped without the flag and turned the Desktop Windows CI
+// Linux job red on main. Every platform build command must pass it.
+describe('electron-builder package scripts', () => {
+  const scripts = JSON.parse(
+    readFileSync(resolve(import.meta.dirname, '../package.json'), 'utf8')
+  ).scripts
+
+  const platformBuilds = Object.entries(scripts).filter(
+    ([, cmd]) => cmd.includes('electron-builder ') && /\s--(win|mac|linux)\b/.test(cmd)
+  )
+
+  it('covers every platform target', () => {
+    expect(platformBuilds.map(([name]) => name).sort()).toEqual([
+      'build:linux',
+      'build:mac',
+      'build:win'
+    ])
+  })
+
+  it.each(platformBuilds)('%s passes --publish never', (_name, cmd) => {
+    expect(cmd).toContain('--publish never')
+  })
+})