Make the Linux and Windows desktop legs clean, and honour published on every macOS delivery

The desktop workflow claims all three platforms are stripped, but only macOS
and Windows had a strip step and the Windows one scrubbed the process PATH
only. Both gaps let a bundle that needs a developer toolchain pass the one
workflow whose premise is that it must not.

Linux: the job ignored strip_toolchain entirely and ran the bundled install.sh
with the runner's git, gcc, cmake and make in /usr/bin. clean-machine-env.sh
now has a Linux --remove branch that moves the resolved tool binaries aside,
recorded in restore.sh, and the job calls it plus `assert absent` after the apt
step (the .deb install needs dpkg) and before the bundled installer, with a
restore step to match macOS. The loop repeats per tool so a name present in
both /usr/bin and /usr/local/bin is fully masked rather than half masked.

Windows: rewriting $env:PATH does not survive the bundled install.ps1, which
calls Refresh-SessionPath (318-337) and rebuilds $env:Path from the Machine and
User registry values, and py.exe in C:\Windows reaches the toolcache whatever
PATH says. Ported the on-disk toolcache rename, the Machine/User registry scrub
and the py -3.11/-3.12/-3.13 start probe from clean-machine-install-ci.yml, so
the strip is proven rather than assumed.

Windows preflight: the log step was Test-Path, Get-Content and Select-String,
none of which can fail, so an app that hangs before preflight passed on the
90 second liveness check alone. It now asserts a tauri.log exists and carries a
`desktop_preflight completed disposition=` line, the same unconstrained check
macOS and Linux already make. The disposition VALUE is deliberately not
constrained: ManagedReady over an unbootable venv is the reported bug.

installer_source on macOS: only the pipe delivery branched on it, so a
`published` dispatch ran the checked-out script on six of the eight macOS rows
while the run was labelled published. The script is now resolved once at the
top of the Install step and used by the file and tauri deliveries; pipe still
re-fetches through the live transport, because that is half of what it tests.
Linux, WSL and Windows already honoured the input.

Also shortened the comments across the changed files, keeping the reasoning
that says why each check exists.

studio/install_python_stack.py

@@ -2736,9 +2736,8 @@ def pip_install_try(
         env = _install_env_for_cmd(cmd),
     )
     if result.returncode == 0:
-        # Same reasoning as pip_install: a successful install that built from
-        # source is exactly what the clean-machine `nobuild` assert exists to
-        # catch, and it can only see what reaches the log.
+        # Same reasoning as pip_install below: `nobuild` can only catch a source
+        # build that reaches the log.
         if VERBOSE and result.stdout:
             print(_redact_install_output(result.stdout))
         return True
@@ -2796,15 +2795,14 @@ def pip_install(
                 **_windows_hidden_subprocess_kwargs(),
             )
             if result.returncode == 0:
-                # Echo the successful output under UNSLOTH_VERBOSE, the same way
-                # install.sh's run_install_cmd does. Dropping it made the whole
-                # dependency phase invisible to anything reading the install log:
-                # .github/scripts/clean-machine-assert.sh's `nobuild` check greps
-                # for uv's "Building <pkg>==<ver>", so a source build here -- and
-                # this is the step that installs studio.txt, where an sdist-only
-                # dependency actually shows up -- left it reporting "built: none"
-                # and the leg green. Redacted, because uv echoes index URLs with
-                # credentials in them.
+                # Echo successful output under UNSLOTH_VERBOSE, as install.sh's
+                # run_install_cmd does. Without it the dependency phase never
+                # reached the install log, and clean-machine-assert.sh's `nobuild`
+                # greps that log for uv's "Building <pkg>==<ver>" -- so a source
+                # build in this step, the one installing studio.txt where an
+                # sdist-only dependency actually shows up, reported "built: none"
+                # and the leg stayed green. Redacted: uv echoes index URLs with
+                # credentials.
                 if VERBOSE and result.stdout:
                     print(_redact_install_output(result.stdout))
                 return