Summary

• allow unsigned macOS/Windows artifacts for draft desktop releases so maintainers can inspect release assets without signing credentials
• remove the unsigned prerelease override input
• keep non-draft releases, including public prereleases, behind the macOS/Windows signing checks

Testing

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/desktop-release.yml"); puts "workflow yaml ok"'\n- git diff --check origin/main..HEAD\n\n## Notes\nDraft releases remain maintainer-only. Public prereleases must be signed.