fix(desktop): bundle @getpaseo/cli in packaged app

The CLI module was dropped from desktop deps in ba9ed8b9 (Knip
false-positive — runtime resolves it via createRequire, which static
analysis can't see). electron-builder then shipped 0.1.63-beta.{1,2}
without app.asar/node_modules/@getpaseo/cli, breaking every daemon
status check from the desktop wrapper. Splash startup never saw the
daemon as ready and retries collided with the live pid lock.

Re-declare the dep, and switch private-workspace internal @getpaseo/*
deps to "*" so npm always resolves the workspace sibling and never
falls back to the registry. Publishable workspaces (cli, server) keep
the root-version pin so their npm tarballs reference real ranges.

Update sync-workspace-versions.mjs to preserve that shape on release
bumps, and add a packaging assertion in desktop-packaging.test.ts that
fails fast if a runtime-required workspace dep is removed again.

packages/desktop/src/daemon/desktop-packaging.test.ts

@@ -16,4 +16,21 @@ describe("desktop packaging", () => {
       "node_modules/@getpaseo/server/dist/src/terminal/shell-integration/**/*",
     );
   });
+
+  // electron-builder packs production dependencies declared in package.json into
+  // app.asar. Runtime code in runtime-paths.ts and bin/paseo dynamically resolves
+  // these workspace packages by string, so static analysis (TypeScript, Knip) cannot
+  // see the link. If a runtime-required workspace dep is dropped from
+  // dependencies, the build still succeeds but ships a broken bundle. This
+  // assertion is the safety net.
+  it("declares all workspace packages required at runtime", () => {
+    const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")) as {
+      dependencies?: Record<string, string>;
+    };
+    const deps = pkg.dependencies ?? {};
+
+    for (const required of ["@getpaseo/cli", "@getpaseo/server"]) {
+      expect(deps[required], `${required} must be declared in dependencies`).toBe("*");
+    }
+  });
 });