fix: harden desktop updater releases

[abolsen]

Summary

• move the Tauri updater endpoint and fallback links to the vaner.ai desktop mirror
• make the update banner install through the signed in-app updater instead of opening GitHub
• emit installer-specific latest.json targets for .deb, AppImage, and NSIS with updater signatures
• add Windows Authenticode verification and an install/launch screenshot smoke test artifact
• show the popover by default on Windows so Winget/Start Menu validation sees UI
• keep the setup wizard model recommendation step and installed Ollama model override

Validation

• pnpm check (passes with existing unused CSS selector warnings)
• pnpm test
• pnpm build (passes with existing unused CSS selector warnings)
• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets -- -D warnings
• workflow YAML parse check for release + CI
• git diff --check

Notes

• Pairs with Borgels/vaner-web#48 for the vaner.ai redirect surface.
• Windows UI smoke runs in the Windows release job and uploads windows-ui-smoke; this Linux dev environment cannot execute that installer screenshot test locally.
• Existing installed 0.3.1/0.3.2 clients still need one manual/apt update before they inherit the new updater behavior.