fix: use tea CLI for macOS release upload + test landing.js version

release-mac.sh get_token() could not read tea's OAuth token (stored
encrypted in the keychain, not config.yml), so it fell back to a stale
git-credential token and 401'd on upload. Replace the curl+token upload
with `tea release create` / `tea releases assets create`, which carry
and refresh the OAuth token automatically.

Add a docs-coverage assertion that landing.js platform download links
point at the current version, so the manual version bump cannot drift.

desktop/src/lib/docs-coverage.test.ts

@@ -3,6 +3,7 @@ import { describe, it, expect } from "vitest";
 // test free of a `node:fs` dependency so `tsc` (bun run build) stays clean.
 import agents from "../../../AGENTS.md?raw";
 import readme from "../../../README.md?raw";
+import landing from "../../../www/public/landing.js?raw";
 
 describe("v0.7.15 docs coverage", () => {
   it("AGENTS.md marks inline cell editing complete", () => {
@@ -69,4 +70,7 @@ describe("v0.7.15 docs coverage", () => {
     expect(readme).toContain("Gridline_0.7.15_aarch64.dmg");
     expect(readme).toContain("Gridline-0.7.15-1.x86_64.rpm");
   });
+  it("landing.js platform download links point to v0.7.15", () => {
+    expect(landing).toContain('const version = "0.7.15"');
+  });
 });