feat(desktop): publish win7 client in workflow

.github/workflows/release-win7.yml

@@ -12,10 +12,13 @@ name: Release Desktop (Win7 legacy)
 #   - Python  3.8        (last CPython to support Win7)
 #
 # This is a SEPARATE, manually-triggered workflow so it never touches the
-# production R2/D1 publish flow or the auto-update feed. It just produces an
-# unsigned NSIS installer and uploads it as a build artifact for manual
-# download + testing. Delete this file whenever Win7 support is no longer worth
-# maintaining — the main pipeline is completely unaffected.
+# production auto-update feed. It produces an unsigned NSIS installer and:
+#   - always uploads it as a build artifact (fallback), and
+#   - when Cloudflare secrets are present, mirrors it to R2 under a dedicated
+#     desktop/win7/ prefix so it can be downloaded fast from cdn.cowagent.ai.
+# It deliberately does NOT touch D1 (no release rows, no is_latest) — this is a
+# throwaway test build, not a published release. Delete this file whenever Win7
+# support is no longer worth maintaining — the main pipeline is unaffected.
 #
 # IMPORTANT for end users: Win7 must have SP1 + update KB2533623 (or the rollup
 # KB4457144) installed, otherwise the Python 3.8 backend still fails to start.
@@ -113,3 +116,32 @@ jobs:
             desktop/release/*.blockmap
           if-no-files-found: warn
           retention-days: 7
+
+      # Mirror the installer to R2 so it downloads fast (GitHub artifacts are
+      # painfully slow from China). Reuses the same cow-skills bucket +
+      # cdn.cowagent.ai domain as the main pipeline, but under a dedicated
+      # desktop/win7/<version>/ prefix. NO D1 write: this is an unpublished test
+      # build. Skips cleanly when Cloudflare secrets aren't configured.
+      - name: Upload installer to R2
+        shell: bash
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          R2_BUCKET: ${{ vars.R2_BUCKET != '' && vars.R2_BUCKET || 'cow-skills' }}
+          VER: ${{ github.event.inputs.version }}
+        run: |
+          # Skip cleanly when Cloudflare isn't configured (secrets are only
+          # readable inside run:, so we gate here rather than in the step `if`).
+          if [ -z "$CLOUDFLARE_API_TOKEN" ]; then
+            echo "::notice::CLOUDFLARE_API_TOKEN not set — skipping R2 upload (use the artifact instead)."
+            exit 0
+          fi
+          shopt -s nullglob
+          for f in desktop/release/*.exe; do
+            base="$(basename "$f")"
+            key="desktop/win7/v${VER}/${base}"
+            echo "==> Uploading $base -> r2://${R2_BUCKET}/${key}"
+            npx --yes wrangler@latest r2 object put "${R2_BUCKET}/${key}" \
+              --file "$f" --remote
+            echo "==> Download URL: https://cdn.cowagent.ai/${key}"
+          done