ci: use external-harfbuzz on all platforms, fix Windows build

- Use external-harfbuzz globally (vendored harfbuzz build.rs has a
  header copy bug on Windows)
- Install harfbuzz[graphite2] via vcpkg on Windows instead of
  standalone graphite2
- Clear CXXFLAGS/CFLAGS on Windows to prevent macOS-specific
  .cargo/config.toml values from leaking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/build-desktop.yml

@@ -56,15 +56,17 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ${{ env.VCPKG_INSTALLATION_ROOT }}/installed
-          key: vcpkg-windows-tectonic-v1
+          key: vcpkg-win-static-release-${{ hashFiles('.github/workflows/build-desktop.yml') }}
 
       - name: Install Windows dependencies (vcpkg)
         if: matrix.label == 'windows'
         shell: bash
+        env:
+          VCPKG_BINARY_SOURCES: "clear"
         run: |
-          vcpkg install fontconfig:x64-windows-static-release \
+          vcpkg install "harfbuzz[graphite2]:x64-windows-static-release" \
+            fontconfig:x64-windows-static-release \
             freetype:x64-windows-static-release \
-            graphite2:x64-windows-static-release \
             icu:x64-windows-static-release
 
       - name: Set Windows build environment
@@ -76,6 +78,9 @@ jobs:
           echo "VCPKGRS_TRIPLET=x64-windows-static-release" >> $GITHUB_ENV
           echo "VCPKG_DEFAULT_HOST_TRIPLET=x64-windows-static-release" >> $GITHUB_ENV
           echo "RUSTFLAGS=-Ctarget-feature=+crt-static" >> $GITHUB_ENV
+          # Override macOS-specific flags from .cargo/config.toml
+          echo "CXXFLAGS=" >> $GITHUB_ENV
+          echo "CFLAGS=" >> $GITHUB_ENV
 
       - name: Setup Apple code signing
         id: signing

apps/desktop/src-tauri/Cargo.lock

@@ -493,6 +493,7 @@ dependencies = [
  "tauri-plugin-process",
  "tauri-plugin-shell",
  "tectonic",
+ "tempfile",
  "tokio",
  "uuid",
  "which 7.0.3",

apps/desktop/src-tauri/Cargo.toml

@@ -31,15 +31,15 @@ git2 = { version = "0.20", default-features = false }
 chrono = "0.4"
 uuid = { version = "1", features = ["v4"] }
 which = "7"
-tectonic = { version = "0.15", default-features = true }
-# NOTE: Building tectonic on macOS requires:
-#   brew install icu4c harfbuzz pkg-config
-#   PKG_CONFIG_PATH="/opt/homebrew/opt/icu4c/lib/pkgconfig" CXXFLAGS="-I/opt/homebrew/include -std=c++17" CFLAGS="-I/opt/homebrew/include"
+tectonic = { version = "0.15", default-features = true, features = ["external-harfbuzz"] }
+# NOTE: Building tectonic requires external harfbuzz/graphite2/icu/freetype:
+#   macOS:   brew install icu4c harfbuzz pkg-config
+#   Linux:   apt install libicu-dev libgraphite2-dev libharfbuzz-dev libfreetype-dev libfontconfig-dev
+#   Windows: vcpkg install harfbuzz[graphite2] freetype icu fontconfig (with TECTONIC_DEP_BACKEND=vcpkg)
 flate2 = "1"
 
-# On Unix, use system-installed HarfBuzz/Graphite2 (Windows uses bundled libraries)
-[target.'cfg(unix)'.dependencies]
-tectonic = { version = "0.15", features = ["external-harfbuzz"] }
+[dev-dependencies]
+tempfile = "3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2 = "0.6"