fix(desktop): support macOS workspace paths in site publishing

[Luhaozhu]

Summary / 概述

• Fix local sidecar command rewriting when the macOS workspace path contains spaces (for example, under Application Support).
• Preserve Bash quoting context while mapping /workspace to the real local path, so publishing archives are created and read as single path arguments.
• Replace GNU-only du -b usage with portable wc -c, add CE regression coverage, and bump the desktop client to 0.2.3.

This is a maintainer CE sync generated from upstream commit b0883fd3 with scripts/build_ce.py.

Related issue / 关联 Issue

N/A — follows up on the macOS desktop local-site publishing failure reported during release verification.

Type of change / 变更类型

• Documentation / 文档
• Example / 示例
• Repo meta / 仓库元信息
• Other / 其他 — upstream-generated CE runtime and desktop fix

Validation / 验证

• CE generation gates: brand scan, forbidden-artifact scan, import/OpenAPI/ORM checks, and release regression suite
• PYTHONPATH=src/backend pytest -q src/backend/tests/test_ce_runtime_contracts.py src/backend/tests/test_local_profile.py src/backend/tests/test_local_subprocess.py — 44 passed, 1 skipped
• npm run test:scripts in desktop/ — 16 passed
• End-to-end local sidecar archive transfer with a workspace path containing spaces
• git diff --check

Checklist / 检查项

• My change only touches non-generated paths — maintainer upstream sync; generated CE paths are intentionally updated
• Links and code snippets have been verified where applicable
• I updated documentation in both languages where applicable (not applicable: no documentation changed in this PR)
• I have read CONTRIBUTING.md