The upgrade and rollback test only ran in CI, against an unsigned build of a
PR. The release itself never ran it, so the installer players download was
never checked. It now runs in the release on the signed installer, after the
signatures are verified and before anything is staged or published.

With the release as the gate, CI builds the desktop app and runs the test
only for PRs that touch Hive (migrations, generated adapters), the installer,
the release scripts, or the test itself, and no longer after every merge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>