fix(desktop): use no-op sign function instead of sign=null

VM run 6 still hit the symlink crash even with signtoolOptions.sign=null.
electron-builder 26.8.1 treats null as 'use the default signtool path'
rather than 'skip signing', so the winCodeSign fetch + extraction still
fired for the bundled prebuild re-sign.

The Electron docs (electronjs.org/docs/latest/tutorial/code-signing)
make it clear signing is OPTIONAL and unsigned apps work fine — users
just see SmartScreen on first launch. The electron-builder mechanism
for 'don't actually sign anything' is to supply a custom sign function
(via signtoolOptions.sign: '<path-to-cjs-module>') that resolves
without invoking signtool.

build-noop-sign.cjs is that module — a 5-line async function that
returns undefined. electron-builder calls it for every binary it would
have signed, gets back a resolved promise, and considers each binary
'signed.' No signtool spawn, no winCodeSign fetch, no symlink crash.

When Nous's cert arrives, replace this file with a real signing hook
(@electron/windows-sign-based or a direct signtool invocation). The
architecture's signing-ready and the cutover is a one-file edit.

apps/desktop/build-noop-sign.cjs

@@ -0,0 +1,28 @@
+// No-op sign function for electron-builder.
+//
+// electron-builder's win.signtoolOptions.sign hook lets you BYO signing
+// logic instead of letting electron-builder fetch signtool from winCodeSign
+// and run it itself. We don't sign on grandma's box (no cert, no cert
+// infrastructure, and the bundled node-pty prebuilds are already signed
+// by their authors upstream).
+//
+// By providing this no-op function, electron-builder:
+//   1. Doesn't try to fetch winCodeSign from GitHub
+//   2. Doesn't try to extract winCodeSign-2.6.0.7z (which fails on
+//      non-admin Windows due to the darwin/*.dylib symlinks needing
+//      SeCreateSymbolicLinkPrivilege)
+//   3. Considers every bundled binary "signed" and moves on
+//
+// The produced Hermes.exe and its bundled prebuild .exes ship unsigned.
+// SmartScreen will warn once on first launch ("More info → Run anyway"),
+// same friction as Hermes-Setup.exe itself. The architecture's signing-
+// ready: when Nous Research's signing cert lands, replace this file with
+// a real signtool invocation or @electron/windows-sign-based hook.
+//
+// Referenced from package.json's build.win.signtoolOptions.sign.
+
+module.exports = async function noopSign(_configuration) {
+  // Intentionally do nothing. electron-builder treats a resolved promise
+  // (or non-Error return) as "signing succeeded."
+  return undefined
+}

apps/desktop/package.json

@@ -202,7 +202,7 @@
         "msi"
       ],
       "signtoolOptions": {
-        "sign": null
+        "sign": "./build-noop-sign.cjs"
       }
     },
     "nsis": {