fix: verify desktop build with cargo

docs/superpowers/plans/2026-07-18-project-workbench-mvp.md

@@ -666,7 +666,7 @@ Last updated: 2026-07-18.
 - [x] Router/main wiring audit: `/api` route registrar 已接入，`cmd/api` 启动时连接 PostgreSQL、执行 AutoMigrate，并注册项目与 Inbox handlers。
 - [x] Search coverage audit: 搜索 service 已覆盖 project、task、note、source、inbox 和 AI session。
 - [x] Credential hygiene audit: 当前文档不再保存真实 PostgreSQL 测试库连接串，集成验证统一通过 `DATABASE_URL` 注入。
-- [ ] Desktop binary verification: blocked by local Rust toolchain state. `rustup` is installed, but `stable-x86_64-pc-windows-msvc` reports `Missing manifest in toolchain`. Run `rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --force` until it completes, then run `npm run build` from `apps/desktop`.
+- [x] Desktop binary verification: Cargo/Rust is available, and `npm run build` from `apps/desktop` passes with `tauri build --no-bundle`, producing `target/release/senlinai_workbench.exe`.
 
 Verification evidence from the latest run:
 
@@ -689,4 +689,5 @@ Verification evidence from the latest run:
 - [x] AI user keys are encrypted at rest and gateway rate-limit checks are covered by tests.
 - [x] Svelte web client calls the backend `/api` prefix, passes type checking, and has Playwright coverage for inbox suggestion confirmation.
 - [x] Current Markdown docs no longer include the live PostgreSQL test credential; integration tests must receive it through `DATABASE_URL`.
-- [ ] Desktop binary build remains blocked on this machine because Cargo/Rust is not available to the shell. Install a complete Rust stable toolchain, then rerun `npm run build` from `apps/desktop`.
+- [x] Desktop executable build passes with Cargo/Rust available: `npx tauri build --no-bundle --verbose` produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
+- [ ] Desktop installer bundling remains blocked on this machine because Tauri CLI packaging times out before producing `target/release/bundle` artifacts. Use `npm run bundle` to retry installer generation.