feat(build): make CEF the default webview runtime across builds, tests, and releases (#641)

- Flip `app/src-tauri/Cargo.toml` `default = ["cef"]` (wry is now opt-in via
  `--no-default-features --features wry`). `cef-dll-sys` auto-downloads the
  Chromium runtime per-target at compile time.
- Update dev scripts: `dev:app` now uses CEF + keychain safe-storage setup;
  `dev:cef` aliased to it; new `dev:wry` for opt-out; `macos:build:*` and
  `tauri:build:ui` switched to `cargo tauri` so the CEF-aware bundler runs.
- Replace `tauri-apps/tauri-action@v0.6.2` / `yarn tauri build` with
  `cargo tauri build` in `build.yml`, `build-windows.yml`, and `release.yml`.
  The upstream `@tauri-apps/cli` binary does not bundle CEF framework files
  into the produced installer — only the fork at `vendor/tauri-cef` does, so
  workflows must use the fork's CLI or the shipped apps fail to launch.
- Bake the CEF-aware `cargo-tauri` into `ghcr.io/tinyhumansai/openhuman_ci`
  by compiling it from the submodule during Docker image build, plus CEF
  runtime libs (libnss3, libgbm1, libxshmfence1, …). Skips the per-run
  cargo-install in the container-based `build.yml`.
- Cache CEF downloads per-OS in matrix jobs (~400MB/platform) and cache the
  compiled `cargo-tauri` binary on raw GH runners (build-windows, release).
- Explicit `gh release upload` step for Linux + Windows installers since the
  tauri-action upload path was removed; macOS keeps its existing re-sign +
  notarize + re-upload flow.

.github/Dockerfile

@@ -2,7 +2,10 @@ FROM ubuntu:22.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# System deps for Tauri + mold linker + clang + E2E testing (xvfb, dbus, webkit2gtk-driver)
+# System deps for Tauri + mold linker + clang + E2E testing (xvfb, dbus, webkit2gtk-driver).
+# CEF (bundled Chromium) runtime libs: libnss3, libnspr4, libgbm1, libxshmfence1,
+# libxkbcommon0, libatk-bridge2.0-0 — required to link/run the CEF shared lib that
+# cef-dll-sys downloads at build time (CEF is the default runtime now).
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     cmake \
@@ -23,6 +26,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     at-spi2-core \
     dbus-x11 \
     webkit2gtk-driver \
+    libnss3 \
+    libnspr4 \
+    libgbm1 \
+    libxshmfence1 \
+    libxkbcommon0 \
+    libatk-bridge2.0-0 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxrandr2 \
+    libcups2 \
+    libpangocairo-1.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
 # Rust 1.93.0 with minimal profile + fmt/clippy
@@ -56,9 +70,22 @@ RUN curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/scca
 # tauri-driver (WebDriver server for Tauri E2E tests)
 RUN cargo install tauri-driver --version 2.0.5
 
+# Vendored CEF-aware tauri-cli. The upstream @tauri-apps/cli binary does not
+# bundle CEF framework files into installers — only the fork at
+# app/src-tauri/vendor/tauri-cef (a submodule) does. We compile it here so
+# release/build workflows can invoke `cargo tauri build` directly without
+# paying the ~5 min compile cost every run.
+#
+# Submodule must be checked out before `docker build` (see docker-ci-image.yml
+# `submodules: recursive`). Source is discarded after install — only the
+# `cargo-tauri` binary in $CARGO_HOME/bin is kept.
+COPY app/src-tauri/vendor/tauri-cef /opt/tauri-cef
+RUN cargo install --locked --path /opt/tauri-cef/crates/tauri-cli \
+    && rm -rf /opt/tauri-cef /usr/local/cargo/registry/cache /usr/local/cargo/registry/src
+
 # E2E entrypoint (starts Xvfb + dbus for headless webkit2gtk testing)
 COPY e2e/docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
 # Verify installs
-RUN rustc --version && cargo --version && node --version && yarn --version && mold --version && sccache --version && which tauri-driver
+RUN rustc --version && cargo --version && node --version && yarn --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version