fix(ci): support desktop release tags

[BrianInAz]

Summary

• accept both historical vX.Y.Z and current desktop-vX.Y.Z stable Buzz Desktop release tags while rejecting relay tags and prereleases
• assign each monitor-created BUILD/SKIP ticket to BrianInAz and retain exact-title deduplication
• add explicit built and accepted closeout states; both are restricted to clean monitor-created tickets and accepted requires built
• document the failed tag-format monitor run, the unapproved desktop-v0.5.3 candidate, and the durable cross-service deviation tracker

This fixes the monitor failure caused by upstream's current desktop-v0.5.3 tag format. It does not approve, build, publish, or install that release.

Related issue

• Track upstream contribution for macOS private-CA WebSocket trust #1
• Triggering run: https://github.com/BrianInAz/buzz/actions/runs/30707522015

Testing

• scripts/test-private-ca-release-contract.sh — passed
• shellcheck scripts/normalize-private-ca-desktop-tag.sh scripts/test-private-ca-release-contract.sh — passed
• workflow YAML parse — passed
• git diff --check — passed
• just ci — Rust, formatting/Clippy, desktop/web checks, 232 core tests, 45 auth tests, database/conformance/push-gateway tests, 3,781 desktop web tests, production desktop/web builds, and 1,877 native desktop tests passed; the unchanged upstream mobile lane failed one deterministic macOS widget assertion (keeps follow mode off while a tall newest message stays visible). The exact test also fails from the unmodified origin/main product tree; no mobile files differ in this PR. GitHub checks remain the merge gate.

No UI or application behavior changes are included.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[BrianInAz]

CI disposition: the macOS build lane failed before compiling this PR because the pinned mesh-llm checkout 43103c5 was absent after cargo fetch (job 91441327170). This PR changes only the private-CA release monitor, its tag parser, tests, and runbook; it does not change Cargo or product code. All completed targeted/Linux desktop and integration lanes are green. After the remaining run jobs settle, I will rerun failed jobs once and record the result; no unrelated mesh-llm workaround will be folded into this PR.

[BrianInAz]

Final CI disposition: failed-job rerun attempt 2 reproduced the same pre-compilation macOS bootstrap failure (mesh-llm checkout for 43103c5 not found after cargo fetch, job 91442555370). PR-scoped contract tests, shellcheck/YAML parsing, Desktop Core, all four Desktop Smoke shards, relay, and both integration shards passed. Because the failure is unchanged upstream CI infrastructure outside this PR’s monitor/runbook scope, it is recorded here rather than hidden or worked around.