One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

cli/lib/workspace.ts

@@ -280,7 +280,7 @@ export function readStoreApps(root: string, accounts: Account[]): { account: str
 // ---- The desktop's state (state.json in its data folder) <-> the workspace ----
 
 export interface DesktopProject { id: string; path: string; name: string; playAccount: string | null; appleAccount: string | null; added: string }
-export interface DesktopAccount { id: string; label: string; kind: Store; created: string; studio: string | null }
+export interface DesktopAccount { id: string; label: string; kind: Store; created: string; studio: string | null; /** 0.8+: the credential profile that holds the key (shared with the CLI) */ profile?: string | null }
 export interface DesktopStudio { id: string; name: string; color: string; logo: string | null; created: string }
 export interface DesktopState {
   version: number;
@@ -315,7 +315,7 @@ export function toDesktopState(ws: Workspace, apps: AppFolder[], now = new Date(
   return {
     version: 2,
     projects: apps.map(a => ({ id: idOf.get(a.id)!, path: a.path, name: a.name, playAccount: a.playAccount, appleAccount: a.appleAccount, added: now })),
-    accounts: accounts.map(a => ({ id: a.id, label: a.label ?? a.profile, kind: a.store, created: now, studio: a.studio })),
+    accounts: accounts.map(a => ({ id: a.id, label: a.label ?? a.profile, kind: a.store, created: now, studio: a.studio, profile: a.profile })),
     studios: studiosOf(ws).map(s => ({ id: s.id, name: s.name, color: s.color, logo: null, created: now })),
     overrides: {
       pairs: o.pairs, unpairs: o.unpairs,
@@ -336,13 +336,14 @@ function profileFor(a: DesktopAccount, taken: Set<string>): string {
 }
 
 /**
- * Desktop state -> workspace. Folders under `root` become relative paths, others stay absolute. Each account becomes
- * a credential profile name (the owner creates ~/.storebound/credentials/<profile>.json; the desktop's keychain is
- * never read). Account ids are kept, so the overrides' store app keys stay valid.
+ * Desktop state -> workspace. Folders under `root` become relative paths, others stay absolute. Each account keeps
+ * its credential profile (0.8+: the app keeps its keys in ~/.storebound/credentials, shared with the CLI), or gets a
+ * profile name to create (accounts of older apps). Account ids are kept, so the overrides' store app keys stay valid.
  */
 export function fromDesktopState(state: DesktopState, root: string): { ws: Workspace; profiles: { profile: string; store: Store; label: string }[] } {
-  const taken = new Set<string>();
-  const profile = new Map(state.accounts.map(a => [a.id, profileFor(a, taken)] as const));
+  // 0.8+ accounts name their credential profile (the app and the CLI share them); older ones get a name to create
+  const taken = new Set<string>(state.accounts.map(a => a.profile).filter((p): p is string => !!p && PROFILE_RE.test(p)));
+  const profile = new Map(state.accounts.map(a => [a.id, a.profile && PROFILE_RE.test(a.profile) ? a.profile : profileFor(a, taken)] as const));
   const acc = (a: DesktopAccount): WsAccount => ({ store: a.kind, profile: profile.get(a.id)!, label: a.label, id: a.id });
   const relOf = new Map(state.projects.map(p => {
     const r = posix(relative(root, p.path));