ci: add manual release promotion to the Desktop bucket

[ibetitsmike]

Why

Promote an existing signed GitHub release to the bucket Coder Desktop installers already use, without rebuilding or re-signing it. The companion infrastructure PR is https://github.com/coder/gcp/pull/229.

Changes

• Add the manual Upload release workflow with a required tag such as v0.18.4.
• Download the five expected payloads and SHA256SUMS, then verify the complete manifest before GCP authentication.
• Upload unchanged files to gs://coder-desktop/mutagen/<tag>/, with generation preconditions that refuse overwrites. Upload the checksum manifest last.
• Reuse the existing repository-bound Workload Identity Federation identity and document the upload procedure and bucket management.

The coder-desktop bucket already exists in project coder-ci and is configured in coder/gcp/projects/production/coder-ci. No destination or bucket settings change is required. The uploader grant in coder/gcp#229 must be approved and deployed before this workflow can upload.

Validation

• actionlint, extracted Bash syntax checks and ShellCheck, and git diff --check passed.
• Downloaded the real v0.18.4 release and verified all five payload checksums against its manifest.
• Local smoke tests covered valid and invalid tags, missing releases/files/checksums, corrupted payloads, unchanged upload contents, and no-overwrite behavior. Red controls removed each guard and caused the corresponding test to fail.
• Signed commits and DCO sign-offs pass scripts/ci/verify_commits.sh.
• Final-head CI passed on 8f033ce8049b1e57354e91150edec3a7da70e710, including Linux, macOS, Windows, and Sidecar.
• The reserved fresh-context final advisory found no material issues. One of six total reviews used; no unresolved threads.

No live upload was attempted. This PR authorizes no merge, infrastructure apply, state import, or release promotion.

Xum prepared this PR on behalf of @ibetitsmike.

PR delivery record

• Completed advisory: one fresh-context final advisory by local Mux task/report 4bcbb6f857. No public report URL is available. This records the existing review, not a new review.
• Reviewed exact commit: 8f033ce8049b1e57354e91150edec3a7da70e710.
• Findings and disposition: no material findings and no known deferred code issues. The advisory was accepted and the review cycle closed; no further rounds were commissioned because no material problems remained.
• Review budget: 1/6 completed reviews total across all reviewers, including the advisory above.
• Recommendation: GO for human review only, not authorization to merge, apply infrastructure, or upload releases.
• Exact-head CI: PR CI and push CI: 11 SUCCESS, 3 SKIPPED.
• Remaining gates: human PR approvals, separately authorized infrastructure deployment (merging coder/gcp#229 triggers apply), and separate authorization for manual release promotion. Live upload remains untested; no merge, apply, or upload was performed.