ci: find the desktop bundles in CARGO_TARGET_DIR, accept Linux aarch64 in latest.json

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -24,6 +24,19 @@ For the external reference images (BitLocker, FileVault 2, dfvfs, AFF4), run `sc
 
 The desktop app signs its update packages: `tauri.conf.json` has `createUpdaterArtifacts` on, so a local `tauri build` needs `TAURI_SIGNING_PRIVATE_KEY` (any key made with `tauri signer generate`; the release key lives only in the repository secrets). For a quick local bundle, pass `--config '{"bundle":{"createUpdaterArtifacts":false}}'`.
 
+## Releases
+
+Pushing a `v*` tag makes the Gitea CI create the release (notes come from `CHANGELOG.md`, so update it first), attach the Linux CLI (x86_64 and aarch64), the desktop app for Linux **aarch64** and Windows, and build the updater's `latest.json`. The runner is arm64, so the Linux **x86_64** desktop app comes from an x86_64 Linux machine:
+
+```bash
+scripts/build-gui.sh linux          # AppImage + .deb (signed) in dist-gui/
+API=https://git.lucasrguerra.dev.br/api/v1/repos/lucasrguerra/guara TOKEN=... \
+  scripts/release-upload.sh vX.Y.Z dist-gui/*
+API=... TOKEN=... python3 scripts/make-latest-json.py vX.Y.Z notes.md latest.json   # then upload it too
+```
+
+There is no macOS build: it needs Apple's SDK and code signing, which a Linux runner cannot provide.
+
 ## Where to make changes
 
 A map of the modules is in [docs/architecture.md](docs/architecture.md). What is missing and what is welcome is in the [ROADMAP](ROADMAP.md).