ci(release): drop the updater job, build linux-x86_64 on the native amd64 runner

Two changes to release.yml, kept together since they touch the same
jobs:

1. Drops the 'updater' job ('Build latest.json'): the desktop app no
   longer reads a Tauri-updater manifest (see the previous commit), so
   nothing consumes it any more. Also drops the now-unused
   GUARA_TAURI_SIGNING_PRIVATE_KEY(_PASSWORD) secrets from the 'gui'
   job's env and the header comment documenting them.

2. Routes the linux-x86_64 leg of the cli and gui matrices to the new
   native x86_64 Gitea Actions runner (hostinger-runner, label
   linux-amd64) instead of cross-compiling it from an aarch64 host
   (oracle-runner/-b, label linux-arm64):
   - matrix.include gets an explicit runner field per platform;
     runs-on: ${{ matrix.runner }} picks it per job. windows also
     pinned to linux-amd64 explicitly rather than relying on the
     ubuntu-latest alias, since that alias now points at whichever
     runner is tagged for it and is no longer a safe stand-in for
     "the aarch64 host" (it briefly meant exactly that, then got
     relabeled to the x86_64 runner — pinning explicit labels avoids
     depending on that alias at all).
   - The "Platform cross-linker" step (gcc-x86-64-linux-gnu) only
     runs when NOT on the native amd64 runner, since a native build
     needs no cross-linker.
   - scripts/build-gui.sh and scripts/package-cli.sh are intentionally
     left untouched: both already branch on `uname -m` and take the
     simple native path when run on x86_64. The existing cross-compile
     path (qemu wrappers, the ELF launcher that survives
     tauri-bundler's dd patch) stays in place as a dormant fallback in
     case the single amd64 runner is ever unavailable — deliberately
     kept, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

.gitea/workflows/release.yml

@@ -1,16 +1,12 @@
 name: Release
 
 # Triggered when a v* tag is pushed: creates the Gitea Release entry with notes
-# from CHANGELOG.md, builds the CLI (Linux x86_64 and aarch64) and the desktop
+# from CHANGELOG.md and uploads the compiled CLI (scripts/package-cli.sh) with
-# app (Linux aarch64, Linux x86_64, and Windows via cargo-xwin cross-compilation),
+# a .sha256 checksum alongside each archive, plus the desktop bundles (Linux
-# and generates the latest.json manifest read by the desktop updater.
+# aarch64, Linux x86_64, and Windows via cargo-xwin).
 #
 # No macOS: Tauri requires Apple's SDK and code-signing hardware/account, which
 # this Linux ARM64 runner does not have.
-#
-# Required repository/user secrets: GUARA_TAURI_SIGNING_PRIVATE_KEY and
-# GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD (sign updater bundles). Unprefixed
-# secret names remain supported as fallback.
 on:
   push:
     tags: ['v*']
@@ -50,22 +46,22 @@ jobs:
   cli:
     name: CLI (${{ matrix.platform }})
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     env:
       CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-cli-${{ matrix.platform }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "" }
+          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "", runner: linux-arm64 }
-          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu" }
+          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu", runner: linux-amd64 }
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
       - name: Platform cross-linker
-        if: ${{ matrix.apt != '' }}
+        if: ${{ matrix.apt != '' && matrix.runner != 'linux-amd64' }}
         run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/cli-x86_64 ${{ matrix.apt }}
       - name: Build and package
         run: scripts/package-cli.sh "${{ gitea.ref_name }}" "${{ matrix.platform }}" "${{ matrix.target }}" | tee packages.txt
@@ -78,15 +74,16 @@ jobs:
   gui:
     name: Desktop app (${{ matrix.platform }})
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     env:
       CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-gui-${{ matrix.platform }}
-      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY || secrets.TAURI_SIGNING_PRIVATE_KEY }}
-      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
     strategy:
       fail-fast: false
       matrix:
-        platform: [linux-aarch64, linux-x86_64, windows]
+        include:
+          - { platform: linux-aarch64, runner: linux-arm64 }
+          - { platform: linux-x86_64, runner: linux-amd64 }
+          - { platform: windows, runner: linux-amd64 }
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
@@ -129,23 +126,3 @@ jobs:
           TOKEN: ${{ gitea.token }}
           API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
         run: scripts/release-upload.sh "${{ gitea.ref_name }}" dist-gui/*
-
-  updater:
-    name: Build latest.json
-    needs: gui
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - name: latest.json
-        env:
-          TAG: ${{ gitea.ref_name }}
-          TOKEN: ${{ gitea.token }}
-          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
-        run: |
-          scripts/release-notes.sh "$TAG" > notes.md
-          python3 scripts/make-latest-json.py "$TAG" notes.md latest.json
-      - name: Upload to release
-        env:
-          TOKEN: ${{ gitea.token }}
-          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
-        run: scripts/release-upload.sh "${{ gitea.ref_name }}" latest.json