fix(ci): correct publish.owner and skip publish in matrix builds

[charlieleith]

Summary

The Build and Release workflow has been failing on every matrix shard. Root cause is in package.json:

"publish": {
  "provider": "github",
  "owner": "p-stream",          // <- doesn't exist
  "repo": "p-stream-desktop"
}

The repo actually lives at xp-technologies-dev/p-stream-desktop. Because GH_TOKEN is set in the matrix step env and a publish block exists in package.json, electron-builder auto-attempts to publish during each build:* invocation. That triggers GET https://api.github.com/repos/p-stream/p-stream-desktop/releases, which 404s, which fails the build before any artifact is uploaded. Every Linux/Windows/macOS shard dies the same way; the release job is then skipped because needs: is unsatisfied.

Failure log excerpt (from run 23325331797, build-linux x64):

method: GET url: https://api.github.com/repos/p-stream/p-stream-desktop/releases
HttpError: 404 Not Found

Fix

Two small changes — either alone unbreaks CI, both together are defensive:

• package.json: publish.owner → xp-technologies-dev so the URL resolves to the real repo.
• .github/workflows/build-and-release.yml: pass --publish=never to every matrix build:* command. The release job already uploads via gh release upload, so electron-builder never needs to touch the releases API in the matrix shards. (This matches what the existing dist script does.)

Test plan

• Re-run Build and Release via workflow_dispatch after merge — all six matrix jobs (linux/win/mac × x64/arm64) should reach the artifact upload step.
• Verified locally: pnpm run build:linux --publish=never produces dist/P-Stream-1.2.6.AppImage (111 MB) without hitting the releases API.

Notes / not in scope

actions/checkout@v4 and actions/setup-node@v4 will be deprecated June 2, 2026 (Node 20 EOL on runners). Worth a follow-up bump, but out of scope here.

[charlieleith]

Pushed an additional commit (5754fdd) extending the same fix to runtime code:

• src/main/auto-updater.js — GITHUB_OWNER constant
• src/main/main.js — autoUpdater.setFeedURL({ owner: ... }) and the two shell.openExternal('https://github.com/p-stream/...releases') calls

Without these, even after a release exists at xp-technologies-dev/p-stream-desktop, every installed/running copy of the app would still 404 on its update checks because the constants were wired to the wrong owner. Confirmed the symptom on a local build:

[AutoUpdater] Error: Error: HTTP 404
    at ClientRequest.<anonymous> (.../src/main/auto-updater.js:69:18)