fix(release): publish binaries despite partial build failures

The Binary Release workflow stopped producing any GitHub Release assets
because every release had at least one failing build leg, and the
github-release job (needs: all four builds, no if:) was skipped whenever
any leg failed — suppressing even successfully-built platforms.

Root causes fixed:
- github-release: add `if: !cancelled()` + zero-artifact guard so a single
  failing leg yields a partial release instead of none.
- setup-node-pnpm cache key: add runner.arch. runner.os is only
  Linux/macOS/Windows, so arm64 runners restored x64 node_modules missing
  native deps (@rollup/rollup-linux-arm64-gnu), crashing `pnpm build`.
- macOS CLI sign step: guard on APPLE_CERTIFICATE_BASE64 so unsigned
  binaries still publish when certs are absent; add timeout-minutes: 30 to
  build-binaries to avoid 24h runner hangs.
- dependency-graph plugin: replace unix cp/mkdir -p (failed on Windows
  cmd.exe) with a cross-platform node copy script.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/fusion-plugin-dependency-graph/package.json

@@ -15,7 +15,7 @@
     }
   },
   "scripts": {
-    "build": "tsc && cp src/*.css dist/ && mkdir -p dist/styles && cp src/styles/*.css dist/styles/",
+    "build": "tsc && node scripts/copy-css.mjs",
     "pretest": "node ../../scripts/ensure-test-artifacts.mjs",
     "test": "vitest run --silent=passed-only --reporter=dot"
   },

plugins/fusion-plugin-dependency-graph/scripts/copy-css.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+// Cross-platform replacement for `cp src/*.css dist/ && mkdir -p dist/styles && cp src/styles/*.css dist/styles/`.
+// The unix commands fail on Windows (cmd.exe), which broke the desktop EXE release build.
+// Copies every .css file under src/ to the mirrored path under dist/, creating dirs as needed.
+import { cp, mkdir, readdir } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = dirname(fileURLToPath(import.meta.url)) + "/..";
+const srcDir = join(root, "src");
+const distDir = join(root, "dist");
+
+async function* cssFiles(dir) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) yield* cssFiles(full);
+    else if (entry.isFile() && entry.name.endsWith(".css")) yield full;
+  }
+}
+
+for await (const file of cssFiles(srcDir)) {
+  const dest = join(distDir, relative(srcDir, file));
+  await mkdir(dirname(dest), { recursive: true });
+  await cp(file, dest);
+}