feat(updates): Move auto-update feed to S3

[charlesvien]

Problem

The auto-update feed is GitHub Releases on PostHog/code, baked into every install. That blocks the monorepo migration: electron-updater's GitHub provider resolves updates through the repo-global /releases/latest pointer, which a monorepo with multiple release trains breaks, and it keeps this repo as a permanent release host. Release notes in the app also come from the GitHub API, which is unauthenticated and rate-limited per IP.

Changes

• electron-builder now publishes with the generic provider pointing at the releases bucket (posthog-desktop-app-releases-prod-us/stable, added in PostHog/posthog-cloud-infra#9385) via its CloudFront distribution at desktop-releases.posthog.com (PostHog/posthog-cloud-infra#9396 made the bucket private behind the CDN; #9535 added the product domain so shipped builds are not coupled to the raw cloudfront.net hostname).
• Release CI uploads binaries and blockmaps to S3 from each platform job, then finalize uploads the channel files last, so updaters only see a release once every platform is up. The Windows manifest travels to finalize as an artifact for that reason.
• Finalize injects the generated notes into latest.yml/latest-mac.yml (the generic provider fetches nothing from GitHub, so UpdateInfo.releaseNotes must come from the manifest) and publishes a releases.json built from the GitHub releases list.
• GitHubReleasesService is renamed to ReleaseFeedService and reads releases.json from the feed instead of the GitHub API; the tRPC route is now releaseFeed.list. Same caching and cooldown behavior, same output shape, so the update modal and What's New UI are unchanged.
• GitHub Releases stay dual-published: installs built before this change still poll PostHog/code, and the release page remains the human changelog and download page.

Needs the AWS_DESKTOP_APP_RELEASES_ROLE_ARN secret (the github-desktop-app-releases-role ARN) before the next release; the role only trusts v* tag workflows.

How did you test this?

• release-feed unit tests (12) pass; typecheck clean on workspace-server, host-router, ui and code; biome clean.
• Ran build-releases-feed.mjs against the real GitHub API and validated the output against the service's zod schema.
• Ran inject-release-notes.mjs against a sample channel file and verified the releaseNotes block.
• Verified the full chain live: a tag-scoped smoke run proved OIDC role assumption, PutObject and the server-side copy flip, and the uploaded object serves with HTTP 200 through the CloudFront domain (the bucket correctly 403s direct public reads).
• Finalize now writes a run-summary markdown table with the CloudFront URL of every published artifact.
• actionlint on the workflow: no new findings (three preexisting SC2035 style notes on untouched lines).

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

😎 This pull request was merged.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 9e14d7b.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "move auto-update feed to s3" | Re-trigger Greptile}