fix: verify desktop build with cargo

docs/mvp-verification.md

@@ -51,12 +51,20 @@ Set-Location ../desktop
 npm run build
 ```
 
-Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stable Rust toolchain is complete.
+Expected: the Tauri desktop executable builds when Rust/Cargo is installed and the stable Rust toolchain is complete.
+
+Installer packaging is a separate step:
+
+```powershell
+Set-Location apps/desktop
+npm run bundle
+```
 
 Current machine status:
-- `rustup` was installed through winget.
-- The latest desktop build attempt fails before project compilation because `cargo` is not available on PATH: `program not found`.
-- Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run `npm run build` from `apps/desktop`.
+- Cargo and rustc are installed under `%USERPROFILE%\.cargo\bin`.
+- If the current shell does not see Cargo yet, prepend `%USERPROFILE%\.cargo\bin` to `PATH` or open a new terminal.
+- `npx tauri build --no-bundle --verbose` passes and produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
+- Full installer bundling through `npm run bundle` currently times out in the Tauri CLI bundling stage on this machine before producing `target/release/bundle` artifacts.
 
 ## Latest Audit Verification
 
@@ -67,7 +75,8 @@ Last audited: 2026-07-18.
 - `apps/web`: `npm test -- --run` passed.
 - `apps/web`: `npm run build` passed.
 - `apps/web`: `npx playwright test` passed.
-- `apps/desktop`: `npm run build` blocked by missing Cargo/Rust toolchain on the current machine.
+- `apps/desktop`: `npx tauri build --no-bundle --verbose` passed and produced the desktop executable.
+- `apps/desktop`: installer packaging is still blocked by Tauri CLI bundling timeout on the current machine.
 
 Audit fixes included:
 

docs/superpowers/plans/2026-07-18-project-workbench-mvp.md

@@ -666,7 +666,7 @@ Last updated: 2026-07-18.
 - [x] Router/main wiring audit: `/api` route registrar 已接入，`cmd/api` 启动时连接 PostgreSQL、执行 AutoMigrate，并注册项目与 Inbox handlers。
 - [x] Search coverage audit: 搜索 service 已覆盖 project、task、note、source、inbox 和 AI session。
 - [x] Credential hygiene audit: 当前文档不再保存真实 PostgreSQL 测试库连接串，集成验证统一通过 `DATABASE_URL` 注入。
-- [ ] Desktop binary verification: blocked by local Rust toolchain state. `rustup` is installed, but `stable-x86_64-pc-windows-msvc` reports `Missing manifest in toolchain`. Run `rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --force` until it completes, then run `npm run build` from `apps/desktop`.
+- [x] Desktop binary verification: Cargo/Rust is available, and `npm run build` from `apps/desktop` passes with `tauri build --no-bundle`, producing `target/release/senlinai_workbench.exe`.
 
 Verification evidence from the latest run:
 
@@ -689,4 +689,5 @@ Verification evidence from the latest run:
 - [x] AI user keys are encrypted at rest and gateway rate-limit checks are covered by tests.
 - [x] Svelte web client calls the backend `/api` prefix, passes type checking, and has Playwright coverage for inbox suggestion confirmation.
 - [x] Current Markdown docs no longer include the live PostgreSQL test credential; integration tests must receive it through `DATABASE_URL`.
-- [ ] Desktop binary build remains blocked on this machine because Cargo/Rust is not available to the shell. Install a complete Rust stable toolchain, then rerun `npm run build` from `apps/desktop`.
+- [x] Desktop executable build passes with Cargo/Rust available: `npx tauri build --no-bundle --verbose` produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
+- [ ] Desktop installer bundling remains blocked on this machine because Tauri CLI packaging times out before producing `target/release/bundle` artifacts. Use `npm run bundle` to retry installer generation.