feat(updater): implement signed in-app update flow

[luisleineweber]

Summary

• implement the signed Tauri updater flow for stable and prerelease releases
• publish signed latest.json through the fixed updater release channel
• download updates first and install them only after Restart to update
• remove the obsolete GitHub installer fallback
• require updater signing in release preflight and publish checks

Validation

• bun run check:frontend
• bun run test:all -- --pool=threads --maxWorkers=1
• bun run check:rust
• cargo test --manifest-path src-tauri/Cargo.toml --locked --lib
• bun run release:check -- --release-tag v0.1.1

Supersedes #10, which was based on the stale updater base branch.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing