build(release): stage local macOS v0.1.0 distribution

docs/guides/client-release.md

@@ -169,6 +169,21 @@ and release directory contain `UNSIGNED-PLATFORM`; the directory must include
 and Gatekeeper or SmartScreen warnings are expected. Later versions return to
 the signed default unless separately approved.
 
+### v0.1.0 staged macOS contingency
+
+The release owner approved one additional v0.1.0 contingency for unavailable
+hosted Actions capacity. A controlled local macOS host may build the macOS
+ad-hoc artifacts from the immutable final `v0.1.0` tag and publish them first.
+That initial GitHub Release must include the DMG, updater package and `.sig`,
+`SHA256SUMS.txt`, provenance, the unsigned-platform warning, and an explicit
+Windows-pending notice. Windows must later be built from the same tag and SHA.
+
+The staged macOS release is an installer distribution, not an activated
+cross-platform updater release. Do not upload or replace production
+`latest.json` until the Windows `NotSigned` installer/updater has been built and
+the combined macOS/Windows feed passes full verification. This fallback is
+limited to v0.1.0 and does not authorize local formal builds for later versions.
+
 ## Windows Release and Internal Validation
 
 Windows x64 NSIS is an approved formal Desktop target. Formal Windows builds
@@ -216,9 +231,19 @@ The formal workflow always requires these organization settings:
 
 - secrets: `TAURI_SIGNING_PRIVATE_KEY` and
   `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`;
+- client default CTMS origin: repository variable `VITE_DESKTOP_SERVER_URL`;
 - shared versioned HTTPS artifact prefix: `DESKTOP_UPDATE_BASE_URL` or the
   manual workflow input.
 
+`VITE_DESKTOP_SERVER_URL` must be an HTTPS origin without credentials, path,
+query, or fragment. Vite embeds it as the Desktop client's first-run default;
+the runtime source must not contain the production hostname. A user can still
+override this default in Desktop server settings, where the persisted manual
+value takes precedence and switching origins clears the existing session and
+server-scoped client state. Do not reuse this value as
+`DESKTOP_UPDATE_BASE_URL`: the latter points to immutable updater artifacts,
+not the CTMS business API.
+
 The default signed path additionally requires `WINDOWS_CERTIFICATE`,
 `WINDOWS_CERTIFICATE_PASSWORD`, and `WINDOWS_TIMESTAMP_URL`, plus the Apple
 credentials documented by the release owner. The v0.1.0 exception does not
@@ -239,6 +264,7 @@ npm ci
 npm run version:check
 export VITE_BUILD_CHANNEL=release
 export VITE_BUILD_COMMIT="$(git rev-parse HEAD)"
+export VITE_DESKTOP_SERVER_URL="https://ctms.example.com"
 npm run release:env:check
 npm run runtime:check
 npm run desktop:release:check