Production hardening: signed and managed Morphir Desktop distribution

## Parent

- #758

## Purpose

Take the Desktop experience proven by the developer and developer-insider steel threads and make it suitable for managed production use.

This issue must not block the developer Desktop MVP or the unsigned power-user release. Start production hardening after those flows have run on real machines and the launch, workspace, logging, update, and repair behavior is understood.

## Scope

### Production repository trust

- Provision the FINOS-hosted Morphir tool TUF repository.
- Name human root-key custodians.
- Publish and retain sequential trusted-root history with threshold root signatures.
- Protect targets, snapshot, and timestamp signing workflows.
- Define expiry, rotation, revocation, recovery, and release-admission procedures.
- Embed the approved initial trusted root in the CLI.

### Operating-system identity

- Establish the required Apple Developer organization account and Windows code-signing account.
- Configure certificates, notarization credentials, protected GitHub environments, secret access, rotation, and recovery.
- Sign Windows Desktop artifacts.
- Sign and notarize macOS Desktop artifacts.
- Document Linux package trust and provenance for supported formats.

### Managed release channels

- Publish durable preview and stable Desktop artifacts from reviewed release workflows.
- Admit release manifests into the production TUF repository.
- Enforce channel compatibility, artifact size, digest, and platform constraints.
- Prevent stable or preview channels from falling back to unsigned developer artifacts.
- Support safe update, repair, rollback, offline launch, and revocation behavior.

### Production operations

- Finish idempotent setup and update reporting.
- Add protected inactive-release pruning.
- Enable bounded automatic cache maintenance.
- Complete Morphir Home migration and supported-platform path conformance.
- Finish Desktop Open Logs and diagnostic-bundle actions.
- Document support, signing renewal, release rollback, and incident procedures.

## Prerequisites

- The developer Desktop MVP can install a local unsigned package through the CLI and launch it with `morphir desktop`.
- The developer-insider steel thread can install a published unsigned artifact on a machine without a source checkout.
- Both earlier threads have been exercised by people on real machines.
- The command and lifecycle behavior are stable enough that production work will harden a proven flow rather than define it.

## Acceptance criteria

- On every supported platform, a clean machine with only `morphir-cli` can run `morphir desktop`, acquire an authenticated and OS-trusted Desktop from preview or stable, and launch without development tools or manual trust bypasses.
- Installed Desktop launches work offline and make no network request in offline mode.
- Failed or revoked updates do not remove the last known-good protected release.
- Root rotation, metadata expiry, channel promotion, artifact revocation, signing-certificate rotation, and rollback have tested procedures.
- Install, update, repair, launch, and failure paths produce correlated local diagnostics beneath Morphir Home.
- Automatic cache cleanup and inactive-release pruning stay within configured bounds and preserve active, rollback, pinned, leased, and unclassified content.
- The supported-platform acceptance suite passes against artifacts from the real production publication path.

## Out of scope

- Building the first useful Desktop experience.
- Local developer package installation.
- Unsigned developer-insider distribution.
- Product workflow and UX changes discovered through early hands-on use.

Those belong to the earlier steel threads in #758.

Begin with parent issue #758 and verify the prerequisite developer and developer-insider Desktop flows using the `morphir desktop` entry point. Map the release, signing, trust, update, repair, and diagnostic requirements to the existing implementation before starting; done means the supported-platform acceptance suite passes against the real production publication path with the listed safety and offline guarantees.

Written by the indexing model from the issue text.