Triggered on v* tags. Builds universal macOS binaries (aarch64 + x86_64)
using tauri-apps/tauri-action@v0, signs updater artifacts with
TAURI_SIGNING_PRIVATE_KEY secret, and publishes to GitHub Releases.
The updater endpoint in tauri.conf.json points to the latest.json artifact
from these releases, completing the OTA update pipeline.
No Apple code signing for now — macOS Gatekeeper will show unsigned-app
warnings until we add notarization in a future task.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
