split bundle config into tauri.{windows,linux,macos}.conf.json so each
platform only carries its own targets; gen-icon emits icon.icns; macos is
ad-hoc signed since arm64 refuses unsigned downloads
releaseDraft: true (needed so build assets land on the same release
object across the two matrix jobs) was never followed by a step that
un-drafted it — the notes job set the changelog but left the release
sitting invisible on GitHub, which also means the auto-updater's
"latest release" lookup never found it (GitHub excludes drafts).
Confirmed against the v1.2.0 run: build + notes both succeeded, but
the release stayed in draft with no publish date. Publish it in the
same step that writes the notes.
Running x64/arm64 tauri-action in parallel let both jobs race on
find-or-create-release for the same tag, producing two release objects
that each only got their own arch's assets (and a latest.json missing
the other platform's entry, breaking auto-update for it).
Signed by a new key (public half embedded in tauri.conf.json, private
half + password live in GitHub secrets). CI now signs release artifacts
and publishes latest.json; the app checks on boot and prompts to
install and restart.
