Desktop release fix — v0.1.0-beta.2

This beta refreshes the public macOS and Windows downloads after the first public beta surfaced installer issues.

• macOS packages now use ad-hoc app signing with sealed resources, fixing the damaged-app failure seen in beta.1 unsigned builds.
• Windows installs are prepared as per-machine installers, matching the expected Program Files installation path.
• First-launch setup now has a manual passphrase fallback when the system keystore is unavailable.
• The download host now publishes beta.2 updater metadata, signatures, checksums, and platform artifacts through dl.onnoir.com.

Before installing a beta update, create and verify an encrypted .onbk backup from Settings.