Ship & validate the v0.1.0 "First Light" release (fix build scripts, add smoke test, push tag)

[Chris0Jeky]

Context

All packaging machinery exists (PKG-01..04 closed, release-desktop.yml, scripts/build-release.*) but no release has ever shipped — verified: git tag count = 0, gh release list empty, the release workflow has never run. Shipping a downloadable v0.1.0 to get the first 5-10 users is the #1 goal in docs/strategy/00_MASTER_STRATEGY.md:45-61.

Evidence

• git tag = 0; no GitHub releases; release-desktop.yml has no runs.
• scripts/build-release.sh:142-149 / .ps1:142-149 use --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true and omit IncludeNativeLibrariesForSelfExtract, diverging from CI release-desktop.yml:119-127 (PublishTrimmed=false, IncludeNativeLibrariesForSelfExtract=true). The script's own comment (build-release.sh:139-141) warns trimming breaks EF migrations/SignalR/reflection; EF Sqlite e_sqlite3 native lib needs extraction in single-file mode; Program.cs:112 runs Database.Migrate() at startup. Likely produces a broken exe.
• scripts/build-release.ps1:43-46 contains a now-FALSE blocking instruction ("Do not ship until PKG-01 merged") though SPA serving is wired (PipelineConfiguration.cs:80 UseStaticFiles, :135 MapFallbackToFile).
• release-desktop.yml:136-143 only checks wwwroot/index.html exists — no launch/smoke test of the published binary.

Acceptance criteria

• Local build scripts match validated CI flags (PublishTrimmed=false, IncludeNativeLibrariesForSelfExtract=true); stale PKG-01 warning blocks removed.
• Release workflow adds a post-publish smoke step per runner-native RID: launch exe with temp data dir + dummy secrets, poll /health/ready, GET / for index.html, shut down; fail release on error.
• v0.1.0 binary smoke-tested end-to-end on a clean VM (first-run auto-secrets, browser launch, capture→review→apply).
• v0.1.0 tag pushed, workflow green, GitHub Release with downloads + checksums published.

Source: deep audit ship-v0.1.0 (CRITICAL + 2 HIGH); critic confirmed the stale build-release.ps1 warning.