ci: configure desktop build-time integrations

[danii1]

Summary

• pass the public GitHub OAuth client ID into pm-desktop release builds
• prefer a repository variable for the optional PostHog host while retaining the existing secret as a fallback
• document which build-time values are Actions secrets versus variables and explicitly prohibit shipping a GitHub client secret

Validation

• validated the workflow as YAML
• ran oxfmt on the changed workflow and release guide
• ran git diff --check