fix(ci): release workspace build + add bundler smoke to ci

Two CI fixes surfaced by the v0.1.0 tag push:

- release.yml: the "Build workspace" step ran
  \`pnpm -r build --filter '!@open-codesign/desktop'\`, which pnpm parsed
  as "run the recursive build script and pass --filter through as args".
  With no package having a build script, pnpm fell into desktop's build
  and forwarded --filter to electron-builder, which choked on the
  unknown argument. Fix by putting --filter BEFORE -r / the script:
  \`pnpm --filter '!@open-codesign/desktop' -r build\`.

- ci.yml: add a bundler smoke step that runs
  \`electron-vite build\` on every push. Catches broken imports,
  missing assets, and bad vite config on main instead of only when a
  tag release lights up. Skip electron-builder packaging (that still
  lives in release.yml where the runner-minute cost is justified).

Author: hqhq1025

.github/workflows/ci.yml

@@ -40,6 +40,12 @@ jobs:
       - name: Test
         run: pnpm test
 
+      # Build smoke — bundle the Electron main + renderer so broken imports,
+      # missing assets, or bad vite config fail here instead of only during a
+      # tag release. Skip electron-builder packaging (that's release.yml's job).
+      - name: Build smoke (electron-vite bundle)
+        run: pnpm --filter @open-codesign/desktop exec electron-vite build
+
   dco:
     name: DCO check
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -156,7 +156,7 @@ jobs:
 
       # Build all workspace packages (turborepo respects dep graph)
       - name: Build workspace
-        run: pnpm -r build --filter '!@open-codesign/desktop'
+        run: pnpm --filter '!@open-codesign/desktop' -r build
 
       # Package the Electron app.
       # CSC_IDENTITY_AUTO_DISCOVERY=false: skip ad-hoc Mac signing prompt.