fix(desktop): bundle @getpaseo/cli in packaged app

The CLI module was dropped from desktop deps in ba9ed8b9 (Knip
false-positive — runtime resolves it via createRequire, which static
analysis can't see). electron-builder then shipped 0.1.63-beta.{1,2}
without app.asar/node_modules/@getpaseo/cli, breaking every daemon
status check from the desktop wrapper. Splash startup never saw the
daemon as ready and retries collided with the live pid lock.

Re-declare the dep, and switch private-workspace internal @getpaseo/*
deps to "*" so npm always resolves the workspace sibling and never
falls back to the registry. Publishable workspaces (cli, server) keep
the root-version pin so their npm tarballs reference real ranges.

Update sync-workspace-versions.mjs to preserve that shape on release
bumps, and add a packaging assertion in desktop-packaging.test.ts that
fails fast if a runtime-required workspace dep is removed again.

scripts/sync-workspace-versions.mjs

@@ -54,6 +54,11 @@ for (const workspacePath of workspacePaths) {
     }
   }
 
+  // Private workspaces (app, desktop) keep "*" for internal deps so npm always
+  // resolves the local sibling, never a registry artifact. Publishable workspaces
+  // get the root version so their published tarballs reference real npm versions.
+  const internalDepRange = pkg.private === true ? "*" : rootVersion;
+
   for (const section of dependencySections) {
     const deps = pkg[section];
     if (!deps || typeof deps !== "object") {
@@ -67,8 +72,8 @@ for (const workspacePath of workspacePaths) {
       if (name === pkg.name) {
         continue;
       }
-      if (deps[name] !== rootVersion) {
-        deps[name] = rootVersion;
+      if (deps[name] !== internalDepRange) {
+        deps[name] = internalDepRange;
         changed = true;
       }
     }