feat(update): unify the updater with Sabiá's Gitea-based mechanism

Replaces the signed tauri-plugin-updater (latest.json manifest, minisign
key pair) with the same simple mechanism Sabiá already uses: query the
Gitea Releases API directly, download the matching platform archive,
verify its SHA-256 checksum, and swap the binary in place. The CI job
that built the old latest.json manifest is removed in the next commit,
alongside an unrelated runner-routing change to the same workflow file.

- New guara-core::update module (check/apply), ported from
  sabia-core::update and adapted to Guará's own release asset naming
  (guara-<tag>-<platform>.tar.gz, matching scripts/package-cli.sh).
- New Engine::update_check / Engine::update_apply, wired into the RPC
  service for the browser UI.
- New CLI subcommand: "guara update" (check) and "guara update --apply"
  (download, verify, replace), mirroring "sabia update".
- GUI: replaced the Tauri plugin-updater flow (download_and_install,
  update-progress events, in-app restart) with a call to the new
  update_check/update_apply commands. The desktop app can no longer
  self-install in one click — it now points the user to the Releases
  page, same as Sabiá's desktop app already does.
- Removed tauri-plugin-updater, createUpdaterArtifacts and the
  updater.pubkey config, the signing-key loading in build-gui.sh, the
  CI step testing the old latest.json generator, and the now-unused
  make-latest-json.py/test_make_latest_json.py scripts.
- Documented the break for existing installs in CHANGELOG.md /
  CHANGELOG.pt-BR.md: versions up to 1.3.2 won't find this release
  automatically and need one manual download.

Trade-off accepted knowingly: SHA-256 verifies integrity against
Gitea's own API but, unlike the retired signed mechanism, does not
protect against a compromised Gitea server independently of it. This
is Lucas's own self-hosted instance, not a third-party mirror.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

scripts/build-gui.sh

@@ -7,11 +7,6 @@
 #   scripts/build-gui.sh windows        # NSIS installer, cross-built from Linux via cargo-xwin
 #   scripts/build-gui.sh windows-docker # Same as above inside an isolated container
 #
-# The Tauri updater signs each bundle (createUpdaterArtifacts: true), so
-# TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_PRIVATE_KEY_PASSWORD must be set
-# in the environment. If unset locally, this script loads ~/.tauri/guara-updater.key
-# when available.
-#
 # Windows builds use cargo-xwin and NSIS (requires: nsis, lld, llvm, clang, and
 # `cargo install cargo-xwin`).
 set -euo pipefail
@@ -20,19 +15,12 @@ cd "$(dirname "$0")/.."
 platform=${1:?usage: build-gui.sh <linux|linux-x86_64|linux-aarch64|windows|windows-docker>}
 tauri() { npx --yes @tauri-apps/cli@2 "$@"; }
 
-if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ] && [ -f "$HOME/.tauri/guara-updater.key" ]; then
-  export TAURI_SIGNING_PRIVATE_KEY="$(cat "$HOME/.tauri/guara-updater.key")"
-  [ -f "$HOME/.tauri/guara-updater.pass" ] && export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$(cat "$HOME/.tauri/guara-updater.pass")"
-fi
-: "${TAURI_SIGNING_PRIVATE_KEY:?set TAURI_SIGNING_PRIVATE_KEY (or generate a local key with 'tauri signer generate')}"
-
 if [ "$platform" = windows-docker ]; then
   docker volume create guara-cargo >/dev/null
   docker volume create guara-rustup >/dev/null
   mkdir -p dist-gui
   exec docker run --rm -v "$PWD":/src -v guara-cargo:/root/.cargo -v guara-rustup:/root/.rustup \
     -w /src -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
-    -e TAURI_SIGNING_PRIVATE_KEY -e TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
     ubuntu:24.04 bash -c '
       set -e
       export DEBIAN_FRONTEND=noninteractive
@@ -81,7 +69,6 @@ case "$platform" in
     rm -rf "$bundle/appimage" "$bundle/deb"
     tauri build --bundles appimage,deb
     cp "$bundle"/appimage/*.AppImage "$bundle"/deb/*.deb ../../../dist-gui/
-    cp "$bundle"/appimage/*.AppImage.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   linux-x86_64)
     if [ "$(uname -m)" = x86_64 ]; then
@@ -169,7 +156,6 @@ EOF
       tauri build --target x86_64-unknown-linux-gnu --bundles appimage,deb
     fi
     cp "$bundle"/appimage/*.AppImage "$bundle"/deb/*.deb ../../../dist-gui/
-    cp "$bundle"/appimage/*.AppImage.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   windows)
     rustup target add x86_64-pc-windows-msvc >/dev/null
@@ -177,7 +163,6 @@ EOF
     rm -rf "$bundle"
     tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc --bundles nsis
     cp "$bundle"/*-setup.exe ../../../dist-gui/
-    cp "$bundle"/*-setup.exe.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   *) echo "unknown platform: $platform" >&2; exit 2 ;;
 esac