release 1.3.2: update from Gitea, Linux-only CLI, desktop app for Linux and Windows

The updater reads latest.json from Gitea, built by scripts/make-latest-json.py
against the Gitea API (no gh CLI). Release workflow builds the Linux CLI and
the Linux+Windows desktop app, signs the updater artifacts and attaches
everything to the release.

Needs the repo secrets TAURI_SIGNING_PRIVATE_KEY and
TAURI_SIGNING_PRIVATE_KEY_PASSWORD, which I could not set (secret-store writes
are reserved for the user) - set them from ~/.tauri/guara-updater.key and
.pass before pushing a tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/build-gui.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Compila o app desktop (Tauri) e deixa os pacotes em dist-gui/.
+#
+#   scripts/build-gui.sh linux     # AppImage e .deb
+#   scripts/build-gui.sh windows   # instalador NSIS, compilado a partir do Linux
+#   scripts/build-gui.sh windows-docker   # o mesmo, num container, sem instalar nada
+#
+# O updater do Tauri assina cada pacote (createUpdaterArtifacts: true), então
+# TAURI_SIGNING_PRIVATE_KEY e TAURI_SIGNING_PRIVATE_KEY_PASSWORD precisam estar
+# no ambiente. Sem eles no ambiente, e com uma chave local em ~/.tauri (gerada
+# por `tauri signer generate`), este script a carrega sozinho.
+#
+# O Windows usa cargo-xwin (SDK do Windows baixado na hora) e o NSIS; o Tauri
+# documenta isso como compilação cruzada experimental. Precisa de: nsis, lld,
+# llvm, clang e `cargo install cargo-xwin`. O .msi não sai daqui (o WiX é só do
+# Windows).
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+platform=${1:?uso: build-gui.sh <linux|windows|windows-docker>}
+tauri() { npx --yes @tauri-apps/cli@2 "$@"; }
+
+if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ] && [ -f "$HOME/.tauri/guara-updater.key" ]; then
+  export TAURI_SIGNING_PRIVATE_KEY="$(cat "$HOME/.tauri/guara-updater.key")"
+  [ -f "$HOME/.tauri/guara-updater.pass" ] && export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$(cat "$HOME/.tauri/guara-updater.pass")"
+fi
+: "${TAURI_SIGNING_PRIVATE_KEY:?defina TAURI_SIGNING_PRIVATE_KEY (ou gere a chave local com 'tauri signer generate')}"
+
+if [ "$platform" = windows-docker ]; then
+  docker volume create guara-cargo >/dev/null
+  docker volume create guara-rustup >/dev/null
+  mkdir -p dist-gui
+  exec docker run --rm -v "$PWD":/src -v guara-cargo:/root/.cargo -v guara-rustup:/root/.rustup \
+    -w /src -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
+    -e TAURI_SIGNING_PRIVATE_KEY -e TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
+    ubuntu:24.04 bash -c '
+      set -e
+      export DEBIAN_FRONTEND=noninteractive
+      apt-get update -qq
+      apt-get install -y -qq curl ca-certificates build-essential pkg-config nsis lld llvm clang nodejs npm unzip >/dev/null
+      [ -x /root/.cargo/bin/rustup ] || curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal >/dev/null
+      export PATH=/root/.cargo/bin:$PATH
+      command -v cargo-xwin >/dev/null || cargo install cargo-xwin --locked
+      scripts/build-gui.sh windows
+      chown -R "$HOST_UID:$HOST_GID" dist-gui apps/gui/src-tauri/target 2>/dev/null || true'
+fi
+
+mkdir -p dist-gui
+cd apps/gui/src-tauri
+
+[ -f icons/icon.ico ] || tauri icon icons/source.png -o icons
+
+case "$platform" in
+  linux)
+    tauri build --bundles appimage,deb
+    bundle=target/release/bundle
+    cp "$bundle"/appimage/*.AppImage "$bundle"/deb/*.deb ../../../dist-gui/
+    cp "$bundle"/appimage/*.AppImage.sig ../../../dist-gui/ 2>/dev/null || true
+    ;;
+  windows)
+    rustup target add x86_64-pc-windows-msvc >/dev/null
+    tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc --bundles nsis
+    bundle=target/x86_64-pc-windows-msvc/release/bundle/nsis
+    cp "$bundle"/*-setup.exe ../../../dist-gui/
+    cp "$bundle"/*-setup.exe.sig ../../../dist-gui/ 2>/dev/null || true
+    ;;
+  *) echo "plataforma desconhecida: $platform" >&2; exit 2 ;;
+esac
+
+ls -1 ../../../dist-gui