fix(release): preserve reviewed legacy destinations

[AprilNEA]

Summary

• add an optional exact-key distribution.desktop.legacyDestination contract so a reviewed release matrix can preserve an immutable pre-matrix Desktop feed without brand-specific code
• select the declared legacy update URL for packaging and the declared bucket/prefix for upload while retaining the single protected release Environment
• validate standard and legacy destinations as one isolation domain, rejecting equal/ancestor/descendant R2 prefixes and update URL paths within or across brands
• require an exact v<package-version> workflow ref before any legacy destination upload, preventing a manual master dispatch from replacing the installed-app feed
• leave all production matrices and fixtures unchanged; this PR does not publish or access credentials

Verification

• pnpm exec vitest run .github/scripts/brand-matrix.test.mjs — 19 tests passed
• release workflow YAML parsed successfully
• pnpm check:ci — format, lint, and typecheck passed (repository baseline lint warnings only)
• pnpm test — 333 files passed, 3 skipped; 2,866 tests passed, 5 skipped

Checklist

• pnpm check:ci and pnpm test both pass
• The affected workflow contract is exercised by focused positive, collision, and wrong-ref tests; no production upload was authorized
• No wire message changed
• No new asset was added
• Release documentation is updated with the new reviewed-matrix contract

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at Aug 15, 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ec6a1195f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at Aug 15, 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}