fix(web): windows project creation path error (double drive letter)

beta: web-v0.2.9-beta.9

beta: server-v0.2.9-beta.9

web v0.2.9

server v0.2.9

desktop v0.2.9

web v0.2.9-beta.8

🐛 Fixes
- Resolve `/ai/chat 400 sessionId is required` triggered when the right
  chat panel was on a fresh scope (new global / new project / new board)
  with no active session in the useChatView store. The empty-string
  fallback in TabLayout defeated `?? createChatSessionId()` in Chat.tsx,
  so every first-message-in-a-new-scope was rejected by the server.

ci: drop R2 + COS dual-write, route CN traffic via CDN

R2 is now the single upload target; clients pick the CDN host on the fly:
- delete sync-r2-to-cos script and COS helpers in publishUtils
- desktop/server/web publish scripts upload to R2 only
- desktop manifest gains top-level baseUrls and platforms[*].url is now
  a relative path; clients join with baseUrls.{cn|global}
- updateConfig adds isCnRuntime detection + localizeUpdateUrl host swap
- ipc get-latest-installer-url joins relative URL with regional base
- workflows drop TENCENT_COS_* env, switch NEXT_PUBLIC_UPDATE_BASE_URL
  and electron-builder publish.url to openloaf-r2.hexems.com

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

chore(desktop): retry beta.71 after Apple agreement re-accepted

beta.70 macOS arm64 build failed because the Apple Developer Program
License Agreement had to be re-accepted (notarisation returned a non-
JSON error page). With the agreement accepted, this release rebuilds
and republishes the missing arm64 dmg so download.json's mac-arm64
link points at a real file again.

Also picks up the multi-arch artifactName / dist scripts and the
test-mac-yml-fix update that were sitting unstaged. CI gains real
fail-fast (committed separately on main) so a future single-platform
break stops the run instead of burning through the remaining matrix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(ci): cleanupOldVersions compatible with Tencent COS

Switch the shared deleteKeys() helper from DeleteObjectsCommand (batch,
up to 1000 keys) to single-object DeleteObjectCommand calls with a
small concurrency window. AWS SDK v3 dropped automatic Content-MD5 in
favour of x-amz-sdk-checksum-algorithm; Tencent COS has not yet
adopted the new header and rejects batch deletes with
"InvalidRequest: Missing required header for this request: Content-MD5".

Single-object delete works against R2 / COS / native S3 alike. The
runtime cost is a few extra seconds per release; trivial for cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>