fix(desktop): harden Windows startup validation

.github/workflows/desktop-build.yml

@@ -422,6 +422,16 @@ jobs:
           EDGE_EVER_VERIFY_TARGET: win32
         run: bun scripts/verify-desktop-package.mjs
 
+      - name: Run packaged Windows sidecar integration tests
+        shell: pwsh
+        run: |
+          $env:EDGE_EVER_SIDECAR_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe").Path
+          $env:EDGE_EVER_MIGRATIONS_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/migrations").Path
+          bun scripts/test-desktop-sidecar.mjs
+
+      - name: Verify packaged Windows first launch
+        run: bun run verify:packaged-desktop-startup -- release/desktop/win-unpacked/EdgeEver.exe
+
       - name: Verify that Preview executables are unsigned
         shell: pwsh
         run: |

.github/workflows/windows-test-signing.yml

@@ -57,6 +57,22 @@ jobs:
       - name: Package unsigned Windows installer
         run: bun scripts/run-desktop-builder.mjs --publish never
 
+      - name: Verify Windows package contents and architecture
+        env:
+          EDGE_EVER_DESKTOP_ARCH: x64
+          EDGE_EVER_VERIFY_TARGET: win32
+        run: bun scripts/verify-desktop-package.mjs
+
+      - name: Run packaged Windows sidecar integration tests
+        shell: pwsh
+        run: |
+          $env:EDGE_EVER_SIDECAR_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe").Path
+          $env:EDGE_EVER_MIGRATIONS_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/migrations").Path
+          bun scripts/test-desktop-sidecar.mjs
+
+      - name: Verify packaged Windows first launch
+        run: bun run verify:packaged-desktop-startup -- release/desktop/win-unpacked/EdgeEver.exe
+
       - name: Verify unsigned Windows installer
         id: installer
         shell: pwsh