fix(desktop-release): don't pass empty APPLE_* — build unsigned (no Apple certs yet)

tauri-action tried 'security import' with an empty APPLE_CERTIFICATE and failed.
The APPLE_* secrets aren't set up, so drop them and build an unsigned .dmg;
re-add them when Apple notarization is configured.

Author: TheTrunk

.github/workflows/desktop-release.yml

@@ -61,12 +61,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # Apple code-signing / notarization is intentionally OFF for now: the
+          # APPLE_* secrets aren't set, and passing them EMPTY makes tauri-action
+          # try `security import` with an empty cert and fail. Result: an UNSIGNED
+          # .dmg (right-click → Open to bypass Gatekeeper). To enable notarized
+          # builds later, add the APPLE_CERTIFICATE / APPLE_CERTIFICATE_PASSWORD /
+          # APPLE_SIGNING_IDENTITY / APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID
+          # repository secrets and re-add them as env here (see docs/14-releases.md).
         with:
           projectPath: clients/desktop
           tagName: ${{ github.ref_name }}