ci(updater): sign artifacts and consolidate updater manifest

Adds TAURI_SIGNING_PRIVATE_KEY(_PASSWORD) env to release-linux,
release-linux-aarch64, and release-macos build steps, collects the
resulting .sig files into the release artifacts, and adds a new
release-updater-manifest workflow that waits for all platform sig
files to land on the release and assembles latest.json for the
updater endpoint.

Cherry-picked from #305 by @afonsojramos.

cc

.github/workflows/release-macos.yml

@@ -95,13 +95,20 @@ jobs:
       - name: Install JS dependencies
         run: npm ci
 
-      - name: Build DMG
-        run: npm run tauri build -- --target ${{ matrix.target }} --bundles dmg
+      - name: Build macOS bundles
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: npm run tauri build -- --target ${{ matrix.target }}
 
       - name: Collect artifacts
         run: |
           mkdir -p dist
+          # DMG for manual distribution
           cp -v src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg dist/ || true
+          # .app.tar.gz + .sig for auto-updater
+          cp -v src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.tar.gz dist/ || true
+          cp -v src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.tar.gz.sig dist/ || true
           ls -la dist
 
       - name: Upload artifacts