#134 feat(downloads): fall back to a configured GitHub releases repo

Summary

The Desktop downloads card (Settings > Workspace) now falls back to a GitHub releases repo when the install has no signed Desktop feed, for example a local Kind stack.

Behaviour

• The signed feed wins. The card loads profiles and manifests as before. It calls GET /cloud/api/v1/desktop/releases only when the feed has no profiles or no releases.
• A 404 from /desktop/releases means no repo is configured, and the card shows today's empty state unchanged. Any other error, a malformed response or release: null also shows the empty state, with no error alert.
• With a GitHub release, the card uses the same UI: the recommended download for the visitor's OS/CPU (and the other format beside it), then all downloads grouped by OS with version, size and SHA-256. Probes stay hidden. The command-line install section is not shown, because its install scripts verify against the signed feed.
• Download buttons go straight to asset.url through the injected navigate, with no signed-URL call. Only https URLs on github.com or objects.githubusercontent.com (no port, no userinfo) are offered. Assets with any other URL are not rendered.
• A muted source line reads "Source: GitHub releases (owner/repo), not the signed Desktop feed. Checksums are from the release's .sha256 files." The repo name links to releasesUrl, but only when that is an https github.com URL. A "Pre-release" badge shows when prerelease is true.

Internally, each release entry now carries a resolve(asset) => url function. For feed releases it is the signed-URL call; for the GitHub release it is the asset's direct URL. contracts.ts adds githubReleasesSchema, and api.ts adds desktopFeedApi.githubReleases(), which returns null on 404.

Tests (src/admin/downloads.test.tsx, route mocked)

• Feed has a release: /desktop/releases is never called and there is no source line.
• No feed + 404: today's empty state, no alert.
• No feed + release: null, or a 502: empty state.
• Feed profiles but no manifests: falls back to GitHub.
• No feed + GitHub release: recommended Linux download plus the .tar.gz alternative, version, Pre-release badge, per-OS list with checksums and macOS floor, probe hidden, source label and link, no CLI section.
• Clicking download navigates to the GitHub URL with no /download-url call.
• An asset whose URL is off GitHub is not rendered, and the recommendation falls back to the remaining build.
• Unit tests for isGithubDownloadUrl.

npm run check is green.

Depends on

The relay-control /desktop/releases route (branch feat/desktop-github-releases). Until that lands, the route returns 404 and this change is inert.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}