chore(desktop-client): gate dev-only debug paths in packaged builds

Wrap the network observer, renderer-devtools proxy (both the main-side
ipc handler registration and the preload-side response listener), and
the auto-open-devtools triggers behind !app.isPackaged so packaged
builds don't ship debugging side channels. Add a tiny console-guard
imported first in renderer/main.ts that no-ops console.* in
import.meta.env.PROD so a packaged build stays quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/renderer-devtools-proxy.ts

@@ -1,4 +1,4 @@
-import { ipcMain } from "electron/main";
+import { app, ipcMain } from "electron/main";
 import type { IpcMainEvent, WebContents } from "electron/main";
 
 interface RendererProxyRequest {
@@ -26,10 +26,17 @@ const pendingRequests = new Map<string, {
 }>();
 const rendererProxyRequestChannel = "desktop:renderer-devtools-proxy:request";
 const rendererProxyResponseChannel = "desktop:renderer-devtools-proxy:response";
+const rendererDevtoolsProxyEnabled = !app.isPackaged;
 
-ipcMain.on(rendererProxyResponseChannel, handleRendererProxyResponse);
+if (rendererDevtoolsProxyEnabled) {
+  ipcMain.on(rendererProxyResponseChannel, handleRendererProxyResponse);
+}
 
 export function registerRendererDevtoolsProxyTarget(webContents: WebContents): void {
+  if (!rendererDevtoolsProxyEnabled) {
+    return;
+  }
+
   rendererWebContents = webContents;
   webContents.once("destroyed", () => {
     if (rendererWebContents === webContents) {
@@ -39,12 +46,17 @@ export function registerRendererDevtoolsProxyTarget(webContents: WebContents): v
 }
 
 export function canUseRendererDevtoolsProxy(): boolean {
-  return Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
+  return rendererDevtoolsProxyEnabled
+    && Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
 }
 
 export async function rendererDevtoolsFetch(
   request: RendererProxyRequest,
 ): Promise<RendererProxyResponse> {
+  if (!rendererDevtoolsProxyEnabled) {
+    throw new Error("renderer_devtools_proxy_unavailable");
+  }
+
   if (!rendererWebContents || rendererWebContents.isDestroyed()) {
     throw new Error("renderer_devtools_proxy_unavailable");
   }