feat(update): unify the updater with Sabiá's Gitea-based mechanism

Replaces the signed tauri-plugin-updater (latest.json manifest, minisign
key pair) with the same simple mechanism Sabiá already uses: query the
Gitea Releases API directly, download the matching platform archive,
verify its SHA-256 checksum, and swap the binary in place. The CI job
that built the old latest.json manifest is removed in the next commit,
alongside an unrelated runner-routing change to the same workflow file.

- New guara-core::update module (check/apply), ported from
  sabia-core::update and adapted to Guará's own release asset naming
  (guara-<tag>-<platform>.tar.gz, matching scripts/package-cli.sh).
- New Engine::update_check / Engine::update_apply, wired into the RPC
  service for the browser UI.
- New CLI subcommand: "guara update" (check) and "guara update --apply"
  (download, verify, replace), mirroring "sabia update".
- GUI: replaced the Tauri plugin-updater flow (download_and_install,
  update-progress events, in-app restart) with a call to the new
  update_check/update_apply commands. The desktop app can no longer
  self-install in one click — it now points the user to the Releases
  page, same as Sabiá's desktop app already does.
- Removed tauri-plugin-updater, createUpdaterArtifacts and the
  updater.pubkey config, the signing-key loading in build-gui.sh, the
  CI step testing the old latest.json generator, and the now-unused
  make-latest-json.py/test_make_latest_json.py scripts.
- Documented the break for existing installs in CHANGELOG.md /
  CHANGELOG.pt-BR.md: versions up to 1.3.2 won't find this release
  automatically and need one manual download.

Trade-off accepted knowingly: SHA-256 verifies integrity against
Gitea's own API but, unlike the retired signed mechanism, does not
protect against a compromised Gitea server independently of it. This
is Lucas's own self-hosted instance, not a third-party mirror.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

apps/gui/src-tauri/src/main.rs

@@ -21,82 +21,15 @@ async fn rpc(
     .map_err(|e| e.to_string())?
 }
 
-/// New version found on Gitea releases.
-#[derive(serde::Serialize)]
-struct UpdateInfo {
-    current: String,
-    version: String,
-    notes: String,
-    /// Whether the app can self-update (AppImage, Windows, and macOS). Package installs
-    /// (.deb/.rpm) only notify the user and open the release page.
-    auto: bool,
-    url: String,
-}
-
-fn self_update_possible() -> bool {
-    !cfg!(target_os = "linux") || std::env::var_os("APPIMAGE").is_some()
-}
-
-/// Checks for a newer version. `None` = already up to date.
 #[tauri::command]
-async fn update_check(app: tauri::AppHandle) -> Result<Option<UpdateInfo>, String> {
-    use tauri_plugin_updater::UpdaterExt;
-    let found = app
-        .updater()
-        .map_err(|e| e.to_string())?
-        .check()
-        .await
-        .map_err(|e| e.to_string())?;
-    Ok(found.map(|u| UpdateInfo {
-        current: u.current_version.clone(),
-        notes: u.body.clone().unwrap_or_default(),
-        url: format!(
-            "https://git.lucasrguerra.dev.br/lucasrguerra/guara/releases/tag/v{}",
-            u.version
-        ),
-        version: u.version,
-        auto: self_update_possible(),
-    }))
+fn update_check(state: tauri::State<'_, State>) -> Result<serde_json::Value, String> {
+    let status = state.0.update_check().map_err(|e| e.to_string())?;
+    serde_json::to_value(status).map_err(|e| e.to_string())
 }
 
-/// Downloads, verifies the signature (embedded public key), installs, and restarts the app.
-/// Progress is emitted via the `update-progress` event.
 #[tauri::command]
-async fn update_install(app: tauri::AppHandle) -> Result<(), String> {
-    use tauri::Emitter;
-    use tauri_plugin_updater::UpdaterExt;
-    if !self_update_possible() {
-        return Err("Esta instalação não se atualiza sozinha (pacote do sistema). Baixe a versão nova na página da release.".into());
-    }
-    let update = app
-        .updater()
-        .map_err(|e| e.to_string())?
-        .check()
-        .await
-        .map_err(|e| e.to_string())?
-        .ok_or("Já está na versão mais recente.")?;
-    let (a, b) = (app.clone(), app.clone());
-    let mut got = 0u64;
-    update
-        .download_and_install(
-            move |chunk, total| {
-                got += chunk as u64;
-                let _ = a.emit(
-                    "update-progress",
-                    serde_json::json!({ "downloaded": got, "total": total }),
-                );
-            },
-            move || {
-                let _ = b.emit("update-progress", serde_json::json!({ "installing": true }));
-            },
-        )
-        .await
-        .map_err(|e| format!("Não foi possível atualizar: {e}"))?;
-    // When running as administrator, the new file is owned by root: hand it back to the invoking user.
-    if let Some(p) = std::env::var_os("APPIMAGE") {
-        guara_core::owner::give_to_user(std::path::Path::new(&p));
-    }
-    app.restart()
+fn update_apply(state: tauri::State<'_, State>) -> Result<String, String> {
+    state.0.update_apply().map_err(|e| e.to_string())
 }
 
 /// `true` when the process already has sufficient privileges to read raw disks.
@@ -308,7 +241,6 @@ fn main() {
     let for_protocol = engine.clone();
     tauri::Builder::default()
         .plugin(tauri_plugin_dialog::init())
-        .plugin(tauri_plugin_updater::Builder::new().build())
         .manage(State(engine))
         .register_asynchronous_uri_scheme_protocol("guara", move |_ctx, request, responder| {
             let eng = for_protocol.clone();
@@ -349,7 +281,7 @@ fn main() {
             is_elevated,
             relaunch_elevated,
             update_check,
-            update_install
+            update_apply
         ])
         .run(tauri::generate_context!())
         .expect("erro ao iniciar o Guará");