Modernize release workflow runners (pingdotgg#2129)

Co-authored-by: codex <codex@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: 3 people

.github/workflows/release.yml

@@ -156,7 +156,7 @@ jobs:
             target: AppImage
             arch: x64
           - label: Windows x64
-            runner: windows-2022 # blacksmith-32vcpu-windows-2025
+            runner: blacksmith-32vcpu-windows-2025
             platform: win
             target: nsis
             arch: x64
@@ -188,6 +188,23 @@ jobs:
       - name: Align package versions to release version
         run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}"
 
+      - name: Install Spectre-mitigated MSVC libs
+        if: matrix.platform == 'win'
+        shell: pwsh
+        run: |
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+             $installPath = & $vswhere -products * -latest -property installationPath
+             $setupExe = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\setup.exe"
+             $proc = Start-Process -FilePath $setupExe `
+              -ArgumentList "modify", "--installPath", "`"$installPath`"", "--add", `
+              "Microsoft.VisualStudio.Component.VC.Tools.x86.x64.Spectre", "--quiet", "--norestart" `
+              -Wait -PassThru -NoNewWindow
+             if ($null -eq $proc -or $proc.ExitCode -ne 0) {
+               $code = if ($null -ne $proc) { $proc.ExitCode } else { 1 }
+               Write-Error "Visual Studio Installer failed with exit code $code"
+               exit $code
+             }
+
       - name: Build desktop artifact
         shell: bash
         env:
@@ -333,19 +350,27 @@ jobs:
   release:
     name: Publish GitHub Release
     needs: [preflight, build, publish_cli]
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
 
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Download all desktop artifacts
         uses: actions/download-artifact@v8
         with: