fix(build): disable npm rebuild for non-macOS platforms in release workflow

.github/workflows/desktop-release.yml

@@ -121,6 +121,14 @@ jobs:
             --publish "${{ inputs.publish || 'always' }}" \
             -c.extraMetadata.version="${{ steps.version.outputs.VERSION }}")
 
+          # node-mac-permissions is the only native dependency and is darwin-only.
+          # electron-builder's internal rebuild would try to node-gyp compile it on
+          # Windows (no Visual Studio) and Linux, so skip the rebuild there. On macOS
+          # the rebuild must stay enabled for per-arch (x64/arm64) builds.
+          if [ "${{ matrix.platform }}" != "--mac" ]; then
+            CMD+=(-c.npmRebuild=false)
+          fi
+
           if [ "${{ steps.sign.outputs.enabled }}" = "true" ]; then
             CMD+=(-c.win.azureSignOptions.publisherName="$WINDOWS_PUBLISHER_NAME")
             CMD+=(-c.win.azureSignOptions.endpoint="$AZURE_CODESIGN_ENDPOINT")

surfsense_desktop/package.json

@@ -11,7 +11,7 @@
     "pack:dir:linux": "pnpm build && electron-builder --dir --linux --config electron-builder.yml -c.npmRebuild=false",
     "dist": "pnpm build && electron-builder --config electron-builder.yml",
     "dist:mac": "pnpm build && electron-builder --mac --config electron-builder.yml",
-    "dist:win": "pnpm build && electron-builder --win --config electron-builder.yml",
+    "dist:win": "pnpm build && electron-builder --win --config electron-builder.yml -c.npmRebuild=false",
     "dist:linux": "pnpm build && electron-builder --linux --config electron-builder.yml -c.npmRebuild=false",
     "typecheck": "tsc --noEmit",
     "postinstall": "node scripts/postinstall-rebuild.mjs"