What

Add Cloudflare CDN cache purge step to desktop-release.yml after R2 upload, matching the existing purge logic in desktop-build.yml.

Why

After a stable release, the latest-mac.yml and nexu-latest-*.dmg/zip URLs served by Cloudflare CDN were not being cache-invalidated. Users' auto-updater would keep seeing the old version manifest until the CDN cache expired naturally.

desktop-build.yml (nightly/beta) already had this purge step, but desktop-release.yml (stable) was missing it.

Also added the missing CLOUDFLARE_ZONE_ID repo secret — without it the purge condition (env.CLOUDFLARE_ZONE_ID != '') was never satisfied, so even nightly/beta purges were silently skipped.

How

• Copy the cache purge step from desktop-build.yml into desktop-release.yml, adapted to use CHANNEL from the artifacts step instead of inputs.update_feed_url
• Purges: latest-mac.yml, latest DMG, latest ZIP — for both ${CHANNEL}/${ARCH} and legacy ${CHANNEL}/ (arm64 only)

Affected areas

• Desktop app (Electron shell)
• Controller (backend / API)
• Web dashboard (React UI)
• OpenClaw runtime
• Skills
• Shared schemas / packages
• Build / CI / Tooling

Checklist

• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes
• pnpm generate-types run (if API routes/schemas changed)
• No credentials or tokens in code or logs
• No any types introduced (use unknown with narrowing)