chore(desktop-client): gate dev-only debug paths in packaged builds

Wrap the network observer, renderer-devtools proxy (both the main-side
ipc handler registration and the preload-side response listener), and
the auto-open-devtools triggers behind !app.isPackaged so packaged
builds don't ship debugging side channels. Add a tiny console-guard
imported first in renderer/main.ts that no-ops console.* in
import.meta.env.PROD so a packaged build stays quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/execution-devtools.ts

@@ -1,3 +1,4 @@
+import { app } from "electron/main";
 import type { WebContents } from "electron/main";
 
 function normalizeBooleanEnv(value: string | undefined): boolean | null {
@@ -16,6 +17,10 @@ function normalizeBooleanEnv(value: string | undefined): boolean | null {
 }
 
 export function shouldAutoOpenExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;
@@ -25,6 +30,10 @@ export function shouldAutoOpenExecutionDevtools(): boolean {
 }
 
 export function shouldAutoOpenBackgroundExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;