feat(update): unify the updater with Sabiá's Gitea-based mechanism

Replaces the signed tauri-plugin-updater (latest.json manifest, minisign
key pair) with the same simple mechanism Sabiá already uses: query the
Gitea Releases API directly, download the matching platform archive,
verify its SHA-256 checksum, and swap the binary in place. The CI job
that built the old latest.json manifest is removed in the next commit,
alongside an unrelated runner-routing change to the same workflow file.

- New guara-core::update module (check/apply), ported from
  sabia-core::update and adapted to Guará's own release asset naming
  (guara-<tag>-<platform>.tar.gz, matching scripts/package-cli.sh).
- New Engine::update_check / Engine::update_apply, wired into the RPC
  service for the browser UI.
- New CLI subcommand: "guara update" (check) and "guara update --apply"
  (download, verify, replace), mirroring "sabia update".
- GUI: replaced the Tauri plugin-updater flow (download_and_install,
  update-progress events, in-app restart) with a call to the new
  update_check/update_apply commands. The desktop app can no longer
  self-install in one click — it now points the user to the Releases
  page, same as Sabiá's desktop app already does.
- Removed tauri-plugin-updater, createUpdaterArtifacts and the
  updater.pubkey config, the signing-key loading in build-gui.sh, the
  CI step testing the old latest.json generator, and the now-unused
  make-latest-json.py/test_make_latest_json.py scripts.
- Documented the break for existing installs in CHANGELOG.md /
  CHANGELOG.pt-BR.md: versions up to 1.3.2 won't find this release
  automatically and need one manual download.

Trade-off accepted knowingly: SHA-256 verifies integrity against
Gitea's own API but, unlike the retired signed mechanism, does not
protect against a compromised Gitea server independently of it. This
is Lucas's own self-hosted instance, not a third-party mirror.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/guara-cli/src/main.rs

@@ -190,6 +190,11 @@ enum Cmd {
     Hash { path: String },
     /// List autosaved sessions
     Sessions,
+    /// Check for and apply `guara` CLI updates
+    Update {
+        #[arg(long)]
+        apply: bool,
+    },
     /// Open the web UI in the browser (local mode)
     Ui {
         #[arg(long, default_value_t = 0)]
@@ -666,6 +671,26 @@ fn run(cli: Cli) -> Result<(), String> {
             }
             Ok(())
         }
+        Cmd::Update { apply } => {
+            let current = env!("CARGO_PKG_VERSION");
+            if apply {
+                let exe = std::env::current_exe().map_err(|e| e.to_string())?;
+                let version = guara_core::update::apply(&exe).map_err(|e| e.to_string())?;
+                println!("atualizado para {version}");
+            } else {
+                let status = guara_core::update::check(current).map_err(|e| e.to_string())?;
+                if status.update_available {
+                    println!(
+                        "atualização disponível: {} -> {} (rode `guara update --apply`)",
+                        status.current_version,
+                        status.latest_version.unwrap_or_default()
+                    );
+                } else {
+                    println!("já na última versão ({})", status.current_version);
+                }
+            }
+            Ok(())
+        }
         Cmd::Ui { port, no_open } => serve::run(port, !no_open),
     }
 }