Summary

• allow unsigned macOS/Windows artifacts for draft desktop releases so maintainers can inspect assets without signing credentials
• require signing for non-draft releases, including public prereleases
• skip the automated desktop version sync PR when publishing a prerelease

Testing

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/desktop-release.yml"); puts "workflow yaml ok"'\n- git diff --check\n\n## Notes\nDraft releases remain maintainer-only. Public prereleases no longer bypass signing.