完善桌面端交互体验与发布检查

docs/guides/client-release.md

@@ -56,6 +56,29 @@ This synchronizes:
 
 Manual edits that leave these files inconsistent fail CI.
 
+## Stabilization Gates
+
+Client release candidates must pass the shared Web checks and the Desktop
+release/security gate before promotion:
+
+```bash
+cd frontend
+npm run version:check
+npm run runtime:check
+npm run desktop:release:check
+npm run ui:contract
+npm run type-check
+npm run test:unit
+npm run build
+npm run desktop:build:app
+```
+
+`desktop:release:check` statically verifies the Tauri bundle, updater public
+key, CSP, capability scopes, command allowlist, query-token ban, and secure
+session token boundary. The full manual release, security, regression, and
+Desktop UX checklist lives in
+`docs/audits/desktop-release-stabilization-checklist.md`.
+
 ## Promotion
 
 1. Merge feature branches into `dev`.
@@ -127,9 +150,12 @@ cd frontend
 npm ci
 npm run version:check
 npm run runtime:check
+npm run desktop:release:check
+npm run ui:contract
 npm run type-check
 npm run test:unit
 npm run build
+npm run desktop:build:app
 export TAURI_SIGNING_PRIVATE_KEY="$UPDATER_PRIVATE_KEY"
 export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$UPDATER_PRIVATE_KEY_PASSWORD"
 npm run desktop:build -- --bundles app