Running x64/arm64 tauri-action in parallel let both jobs race on
find-or-create-release for the same tag, producing two release objects
that each only got their own arch's assets (and a latest.json missing
the other platform's entry, breaking auto-update for it).
Signed by a new key (public half embedded in tauri.conf.json, private
half + password live in GitHub secrets). CI now signs release artifacts
and publishes latest.json; the app checks on boot and prompts to
install and restart.