Prevent Windows macOS nodes chasing unpublished

`GET /api/agent/release-desired` answers the CP's own version to every node (`apps/api/app/version.py::stamped_release`). Linux gets it from apt; Windows/macOS fetch `dist/<platform>/jaah-<ver>-<platform>.{zip,tar.gz}` (published by `node-publish-platforms` in `.github/workflows/jaah-deploy.yml`, decoupled from the Linux publish on purpose). When the platform-bundle job fails or is cancelled (prod run 40432034875 on 2026-10-27, 1.2.4746: cancelled mid-build), every Windows/macOS node chases a version that will never be downloadable — a 10-minute retry loop every 30 minutes, "behind" until the next prod deploy, and the Nodes list blames the node. - Make the desired release platform-aware: a Windows/macOS node is told the newest version whose `.sha256` sidecar exists under `dist/<platform>/` (head-object, cached), so it converges as far as it can. - Show the operator when the current release has no bundle for a platform (Nodes list / node detail), so "behind" reads as "no Windows bundle for 1.2.X" rather than a node fault. - Consider letting `node-publish-platforms` be re-run alone for a cancelled run (it already re-checks sidecars). Out of scope: Linux updates; the Windows updater's log shipping (Task 10528 shipped it). Done means: - A release whose windows-x64 bundle is missing leaves Windows nodes on the newest published bundle with no failed retry loop, and the console names the missing bundle.

PR #7118 queued: macOS/Windows nodes are now told the newest release with a published bundle, using a .sha256 HEAD and a LATEST pointer the publish job writes, never backwards. The console shows "No Windows bundle for X". Quick gate and changed-area tests green; visual check done.