Add signed in-app update flow

[luisleineweber]

Summary

Add a signed in-app updater flow based on the staged download and restart pattern used by T3Code.

• Keep the Windows Authenticode certificate separate from the free Tauri updater key.
• Keep this PR in draft while the new update channel is validated.

Problem

Unsigned prereleases only expose the GitHub installer. The app can discover a newer release, but it opens the release page instead of downloading and installing the update.

GitHub's releases/latest alias also excludes prereleases. The existing endpoint cannot serve Alpha update manifests.

UX Flow

Current flow
└─ Update found
   └─ Open GitHub release page
      └─ User downloads and runs installer manually

Desired flow
└─ Update found
   └─ User selects Update
      └─ App downloads and shows progress
         └─ User selects Restart to update
            └─ App installs and relaunches

Solution

Use the signed Tauri updater as the only update source. Publish each latest.json through a fixed public updater release, so prereleases do not depend on GitHub's stable-only alias.

Split download from installation. A failed download stays available for retry. Installation starts only from the downloaded ready state.

The release workflow requires TAURI_SIGNING_PRIVATE_KEY and verifies the manifest, updater signature, and Windows installer before it updates the channel manifest.

The new public key is now in src-tauri/tauri.conf.json. The matching private key and password are configured as GitHub Secrets.

Draft status

The free Tauri signing key is configured. The PR remains a draft until a real signed prerelease is published and the in-app update path is validated.

Alpha 7 cannot trust the rotated key. Users need one final manual installation of the rebuilt Alpha 8. Later releases can update fully in-app.

Windows Authenticode signing remains separate and optional for Alpha technical previews.