refactor(client): unify web and desktop release workflow

docs/branch-governance.md

@@ -78,6 +78,27 @@ Meaning:
 
 Direct promotion that skips stages is discouraged and must be justified in writing.
 
+## 3.1 Unified Web and Desktop Mainline
+
+CTMS Web and Desktop are two delivery targets of the same product version. They
+share the Vue application, API contract, and product branches.
+
+Rules:
+
+- Do not create long-lived `web-dev`, `desktop-dev`, `web-release`, or
+  `desktop-release` branches.
+- Web and Desktop changes both follow `feature/*` -> `dev` -> `main` ->
+  `release`.
+- A platform-specific feature branch is allowed while work is in progress, for
+  example `feature/desktop-file-picker`, but it must merge back into `dev`.
+- `codex/ctms-desktop` is a temporary desktop integration branch. After the
+  Tauri baseline is accepted into `dev`, new desktop work must use short-lived
+  feature branches from the current `dev`.
+- Platform differences belong behind `frontend/src/runtime/`. Shared business
+  modules must not import Tauri APIs directly.
+- A release tag identifies one product source state. Web and Desktop artifacts
+  for that release must be built from the same tag and Git commit.
+
 ## 4. Branch Entry Rules
 
 ### Changes allowed into `dev`
@@ -214,6 +235,13 @@ Rules:
 - tags are created on `release`, not on `dev`
 - a tag must point to the exact production release commit
 - patch hotfixes on `release` should increment the patch version
+- Web and Desktop use the same semantic version. Do not add a separate Desktop
+  product version.
+- Desktop packaging-only rebuilds may add build metadata to the artifact name,
+  but must retain the product version and record the source commit.
+- Before creating a tag, run `cd frontend && npm run version:check`.
+- Change the shared client version with
+  `cd frontend && npm run version:set -- <version>`.
 
 ## 7. Hotfix Back-Merge Rules