desktop: put this computer health first

The Agent now owns one local view of machine health and top processes. RedFlag opens at dashboard scale, names itself plainly, and renders that evidence before updates.\n\nCI now compiles the Tauri bridge before release day.

.gitea/workflows/ci.yml

@@ -129,6 +129,28 @@ jobs:
       - name: Build web UI
         run: cd web && npm ci && npm run build
 
+  desktop-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - name: Install Tauri system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev
+      - name: Check RedFlag desktop
+        run: |
+          cd web
+          npm ci
+          npm run build:desktop
+          cd ../desktop
+          cargo check
+
   installer-integrity:
     runs-on: ubuntu-latest
     steps:
@@ -262,7 +284,7 @@ jobs:
   # public SHA to Forgejo, without force, then reads it back anonymously.
   sync-public:
     runs-on: ubuntu-latest
-    needs: [go-vet, go-test, rust-test, cross-compile, web-build, installer-integrity, dep-scan, no-ai-attribution, action-pins, public-history]
+    needs: [go-vet, go-test, rust-test, cross-compile, web-build, desktop-check, installer-integrity, dep-scan, no-ai-attribution, action-pins, public-history]
     if: github.ref == 'refs/heads/public'
     env:
       PUBLIC_FORGE_TOKEN: ${{ secrets.PUBLIC_FORGE_TOKEN }}