ci: deduplicate native release builds

[abrichr]

Summary

• synchronize native version sources inside the semantic-release commit
• let the freshness workflow tag that exact commit without a second main push
• keep the immutable desktop-v* installer matrix as the release gate

Verification

• 29 focused native release tests pass
• Ruff lint passes
• git diff --check passes

This removes the duplicate cross-platform installer matrix that ran after the 0.15.0 version-sync commit. It does not remove the immutable-tag build, smoke tests, checksums, attestations, or publication approval.