build(release): promote macos updater independently

[kalvinnchau]

summary

Temporarily excludes Windows and Linux from the rolling auto-update channel while preserving their release build pipelines.

pipeline changes

• Windows and Linux continue to compile, package, sign, checksum, attest, and upload their release artifacts.
• Their release builds use BERD_RELEASE_CHANNEL=disabled; Linux also sets VITE_UPDATER_ENABLED=false. This prevents those binaries from registering or querying the public updater feed.
• BERD_UPDATER_PUBLIC_KEY is scoped to each packaging step so the updater archives are still signed and verified without enabling updater behavior in the application.
• The promotion job depends only on setup and stage-macos, and verifies only the staged darwin-aarch64 payload.
• Promotion derives a temporary channel configuration with platforms = ["darwin-aarch64"], so the existing promotion script publishes only the macOS archive and manifest entry.
• Windows and Linux artifacts remain available on the immutable versioned release for manual validation, but are not copied to the rolling updater release and do not gate macOS promotion.

re-enabling a platform

docs/release-and-updates.md documents the required workflow changes: restore the public updater profile in the platform job, add the staging job back to the promotion dependency and verification gates, and add the platform identifier to the promotion configuration after installation and update testing is complete.

validation

• pnpm test:release-scripts — 79 tests passed
• just check
• just fmt-check
• just tauri-check