Wire desktop updates through a generic feed

electron-builder now publishes latest-linux.yml / latest.yml and embeds
app-update.yml plus package-type, so electron-updater runs pacman -U or
dpkg -i through pkexec for packages and updates the per-user NSIS install
without elevation. The app checks only when asked (menu item), asks before
downloading and before installing, and J621_UPDATE_URL overrides the feed
for tests or forks.

deploy/push_desktop.sh builds and publishes the artifacts to
deploy/data/desktop, which the frontend nginx mounts read-only at
/desktop/. Verified detection and up-to-date handling against a local feed
with the packaged Arch build.

desktop/electron-builder.yml

@@ -2,6 +2,13 @@ appId: io.j621.desktop
 productName: J621
 copyright: Copyright (c) 2026 JakeBreath — Jake Labs Non-Commercial Software Licence
 
+# Update feed served by the frontend nginx (deploy/data/desktop, published
+# with deploy/push_desktop.sh). Baked into resources/app-update.yml; override
+# at runtime with J621_UPDATE_URL for a fork or a test feed.
+publish:
+  provider: generic
+  url: https://j621.rainbow-herring.ts.net/desktop
+
 directories:
   output: release
   buildResources: build