fix: restore packaged runtimes and ship macOS DMG only

Desktop 0.12.7 omitted OpenCode's offline node_modules because the resource
copier excludes node_modules at its source root. Copy from the parent and
verify every prepared configuration file in the final package. Bundle DSH
session projection with the unpacked Host instead of leaving an ASAR-only
external import, and reject external DeepSeek imports in shipped chunks.

Run packaged OpenCode plugin import and the real DSH UtilityProcess handshake
in Windows x64 CI before removing unpacked output. Add regressions using the
actual electron-builder copier and Vite externalization configuration.

Prepare approved Desktop 0.12.8 notes and change macOS defaults and CI to DMG
only. Update aggregation, website downloads and update readers for 12
installers and 20 assets. Current readers retain historical DMG/ZIP support;
the user accepts that older macOS GitHub readers and all older mirror readers
need manual upgrades. Agent remains 0.11.21, with no new Agent or LoongArch tag.

Validation: 3608 tests passed, 0 failed, 61 skipped across 339 files;
typecheck, lint, release-note validation, website static checks and 18 website
tests passed. No local production build or packaged-app launch was performed
at the user's request; actual packaged startup validation runs in CI.

Release note: 修复安装后 OpenCode 离线依赖缺失和 DeepSeek Harness Host 启动退出；macOS 改为仅提供 DMG，受影响旧版用户需从下载页手动升级。

FEATURES.md

@@ -21,7 +21,7 @@ otherwise.
   packages target compatible x64 and arm64 environments, including UOS, Kylin,
   Hygon, Zhaoxin, Kunpeng, and Phytium systems. This is not vendor certification.
   LoongArch has a separate experimental loong64 preview outside standard
-  releases and automatic updates; no preview is planned for 0.12.7. See the
+  releases and automatic updates; no preview is planned for 0.12.8. See the
   [preview boundaries](./docs/development/loongarch-preview-build.md).
 - [x] **Configurable global shortcut**: Enable, disable, or record an Electron
   accelerator under Platform Features / General. The default remains
@@ -174,7 +174,7 @@ otherwise.
   failure, Agent `SIGKILL`/restart, and recovery from a reopened Desktop SQLite
   database. Successful tool START/END events appear exactly once, with no
   Prompt, provider, or tool replay observed. The current Agent source lock is
-  `0.11.21`, while the current Desktop release candidate is `0.12.7`; formal
+  `0.11.21`, while the current Desktop release candidate is `0.12.8`; formal
   publication status follows the separate Agent and Desktop
   release channels. Current macOS source has passed native package installation,
   detached lifecycle, Attach, real Ask/Execute, and cancellation of tools in
@@ -567,7 +567,17 @@ otherwise.
   build commands.
 - [x] **Six-target native release matrix**: Native runners build Windows,
   macOS, and Linux `x64` and `arm64` targets with release manifests and SHA-256
-  hashes. Linux also produces AppImage, DEB, and RPM.
+  hashes. Windows provides NSIS and portable ZIP, macOS DMG only, and Linux
+  AppImage, DEB, and RPM, for 12 installers and 20 published assets.
+- [x] **Desktop Runtime package verification**: Offline OpenCode dependencies
+  are copied without electron-builder's root node_modules exclusion; DSH
+  session projection is bundled into the unpacked Host. Final package checks
+  compare the offline dependency tree and reject external DeepSeek imports.
+  Windows x64 CI additionally imports the packaged OpenCode plugin and checks
+  the real DSH UtilityProcess handshake before publishing.
+- [x] **DMG-only update manifests**: Current Desktop and website readers accept
+  DMG-only and historical DMG/ZIP manifests. Older macOS GitHub readers and all
+  older mirror readers require a manual upgrade from the download page.
 
 ### Open interfaces, team collaboration, and remote execution