ci(desktop): fix unsigned macOS builds and Linux Electron sandbox

[venkateshsakamuri-lab]

Summary

Fixes the desktop-v1.0.0 CI failures that blocked publishing DeepSQL Desktop installers. After this lands, re-tag / re-run desktop-release so /download has assets.

Root causes (from failed run)

Platform	Failure
Linux	Tunnel selftest: Electron aborts — chrome-sandbox lacks root:4755 on hosted runners
macOS	electron-builder treated empty CSC_LINK (unset secret → empty string) as a file path → …/desktop not a file
Windows	Cancelled after sibling failures; never reached builder

Changes

• Selftest: ELECTRON_DISABLE_SANDBOX=1 (sandbox irrelevant for headless CI)
• Build: only export CSC_* when DESKTOP_CSC_LINK is non-empty; otherwise CSC_IDENTITY_AUTO_DISCOVERY=false for unsigned installers
• desktop/README.md: document the CI behavior

After merge

# Option A — new patch tag from main
git checkout main && git pull
git tag -a desktop-v1.0.1 -m "DeepSQL Desktop v1.0.1"
git push origin desktop-v1.0.1

# Option B — re-run workflow_dispatch on main, then attach assets manually

Then confirm the desktop-v* GitHub Release has dmg/zip/exe/AppImage/deb and /download lists them.

Test plan

• CI green on this PR
• After merge: desktop-release succeeds on macOS + Linux + Windows
• Release assets appear; /download no longer shows empty state