Disable implicit builder publishing

[wisdomqin]

What changed

• adds --publish never to all electron-builder packaging scripts
• keeps tag builds focused on producing artifacts
• leaves GitHub Release creation to the dedicated publish job after all three platforms succeed
• adds a regression test for the no-implicit-publish contract

Root cause

electron-builder detected the v0.1.0 tag and attempted implicit publishing from each platform build. Those jobs intentionally do not receive a GitHub token, so they failed after successfully producing installers.

Validation

• npm test (23 tests)
• npm run typecheck
• npm run package:mac:arm64
• git diff --check