perf(desktop): lock Windows local-service dependencies

[Luhaozhu]

Summary / 概述

• Add a dedicated desktop dependency profile and an exact Windows Python 3.11 lock for the bundled local service.
• Reuse an existing virtual environment when the dependency fingerprint is unchanged, and perform a single locked uv pip sync when dependencies change.
• Prefer a reachable domestic package mirror with an official PyPI fallback, while allowing deployments to configure their own PEP 503 index.
• Include dependency inputs and their fingerprint in the CE desktop payload, with regression coverage for lock exactness, line-ending stability, and installer behavior.

Validation:

• npm --prefix desktop run test:scripts — 21 passed.
• Clean CE generation passed runtime-file, forbidden-output, binary-asset, brand, and license gates.
• A signed Windows production build completed and produced the NSIS updater artifact from this dependency profile and lock.
• git diff --check passed. The repository has no root npm run preflight script, so the relevant desktop and CE checks above were used.

Related issue / 关联 Issue

None.

Type of change / 变更类型

• 📖 Documentation (document/**, README*.md)
• 🧩 Example / sample (examples/**)
• 🔧 Repo meta (CI, templates, .github/**)
• Other (please describe / 请说明): Maintainer sync of an upstream Windows desktop installer and dependency-management improvement.

Checklist / 检查项

• My change only touches non-generated paths (docs / examples / repo meta). 仅改动非生成路径。
• Links and code snippets were verified. 链接与代码片段已验证。
• For bilingual docs, I updated both document/en/** and document/zh-CN/** where applicable. 双语文档已同步更新（如适用）。 Not applicable; no bilingual product documentation changed.
• I read CONTRIBUTING.md. 我已阅读贡献指南。