One product per machine: the CLI and the desktop app share one version, the store accounts and the app folder list

- one version: package.json's version is the desktop app's too (desktopVersion removed); tools/desktop-version.ts
  keeps the plugin manifests and the app's copies equal, desktop-release publish refuses another version, release
  order app first then npm publish; the unpublished desktop 0.1.0 candidate is noted in the docs and CHANGELOG
- storebound desktop installs (per user, no admin: macOS DMG -> /Applications or ~/Applications, Windows NSIS /S,
  Linux AppImage + .desktop with the storebound:// handler), updates an older app, notes a newer one (downgrade only
  with --force), asks once ([Y/n], --yes, exit 3 without a terminal), opens on the folder; --dry / --json / --download;
  the install steps are pure plans (cli/lib/desktop-install.ts); the version's own manifest dl/<version>/latest.json
- credentials: one store, the CLI's credential profiles in ~/.storebound/credentials; the desktop writes and reads
  them (profiles.rs, files 0600), moves old keychain accounts into profiles on first start, shows profiles the CLI
  made; precedence env > named profile > project file > default profile; config `account`, "account" in the
  project's credentials.json; storebound accounts list | import (dedup by key id / service account e-mail, key files
  copied 0600, project file keeps keystore and review contact, backup, --dry, never prints values) | use
- app folders: one list ~/.storebound/projects.json shared by the desktop (registry.rs), storebound desktop,
  apps folders | add | remove, ws init and ws without a workspace file
- desktop: notice when a folder pins another storebound version; storebound-desktop --version
- tests: version drift, desktop decisions and per-OS plans, credential precedence and import, registry (TS + Rust),
  keychain migration and profile round trip (Rust), boot check with old keychain state and the new shared state

tools/desktop-release.ts

@@ -19,12 +19,14 @@
 //   bun tools/desktop-release.ts publish --out <dir> --host <user@host> [--channel stable|beta] [--yes]
 //     Checks the folder again, uploads it to the server's incoming folder (rsync) and runs the root-owned publish
 //     script there (tmp -> mv, latest.json last). Without --yes it only prints the plan (dry run).
+//     The folder's version must be package.json's: the npm CLI and the app are released together, the app first,
+//     then `npm publish` of the same version.
 //   bun tools/desktop-release.ts verify --out <dir>
 //     The checks of publish without uploading.
 //   bun tools/desktop-release.ts exec -- <command...>
 //     Runs a build command (tauri build on a runner) with the path-free environment described at pathFreeEnv.
 //
-// Version: package.json "desktopVersion" (bun tools/desktop-version.ts). Docs: docs/desktop-release.md.
+// Version: package.json "version", the same as the npm CLI (bun tools/desktop-version.ts); both ship together. Docs: docs/desktop-release.md.
 import { spawnSync, type SpawnSyncOptions } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
@@ -634,6 +636,13 @@ function verifyFolder(out: string): { manifest: Manifest; files: string[] } {
   return { manifest, files };
 }
 
+/** The npm CLI and the desktop app are one release: the folder must be the version of this checkout's package.json
+ *  (the CLI that `npx storebound desktop` installs it for). Pure. */
+export function releaseTogetherProblems(folderVersion: string, pkgVersion: string | null): string[] {
+  if (!pkgVersion) return ['package.json has no version'];
+  return folderVersion === pkgVersion ? [] : [`the folder is desktop ${folderVersion} but package.json (the npm CLI) is ${pkgVersion}: the CLI and the app ship with one version (bun tools/desktop-version.ts --set ${folderVersion}, or build the folder from the release commit)`];
+}
+
 function publish(argv: string[]): void {
   const a = args(argv);
   const out = resolve(a.get('out') ?? fail('--out <version folder> is required'));
@@ -643,6 +652,8 @@ function publish(argv: string[]): void {
   if (!['stable', 'beta'].includes(channel)) fail('--channel stable or beta');
   const { manifest, files } = verifyFolder(out);
   const v = manifest.version;
+  const together = releaseTogetherProblems(v, versions().version);
+  if (together.length) fail(together.join('; '));
   const unsigned = Object.values(manifest.downloads ?? {}).filter(d => !d!.codeSigned && /\.(dmg|exe)$/.test(d!.file)).map(d => d!.file);
   const steps = [
     ['ssh', host, `mkdir -p ${REMOTE_INCOMING}/${v} && chmod 700 ${REMOTE_INCOMING}`],
@@ -659,6 +670,7 @@ function publish(argv: string[]): void {
   const live = spawnSync('curl', ['-fsS', channel === 'stable' ? `${BASE_URL}/latest.json` : `${BASE_URL}/beta/latest.json`], { encoding: 'utf8' });
   if (live.status !== 0 || (JSON.parse(live.stdout) as Manifest).version !== v) fail('latest.json on storebound.dev is not the new version yet');
   say(`live: ${BASE_URL}/ serves ${v}`);
+  say(`next, the same release: npm publish of storebound ${v} (CONTRIBUTING.md). \`npx storebound desktop\` of ${v} installs or updates to this app.`);
 }
 
 if (import.meta.main) {