release 1.3.2: update from Gitea, Linux-only CLI, desktop app for Linux and Windows

The updater reads latest.json from Gitea, built by scripts/make-latest-json.py
against the Gitea API (no gh CLI). Release workflow builds the Linux CLI and
the Linux+Windows desktop app, signs the updater artifacts and attaches
everything to the release.

Needs the repo secrets TAURI_SIGNING_PRIVATE_KEY and
TAURI_SIGNING_PRIVATE_KEY_PASSWORD, which I could not set (secret-store writes
are reserved for the user) - set them from ~/.tauri/guara-updater.key and
.pass before pushing a tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/package-cli.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Compila o CLI para uma plataforma e empacota: guara-<tag>-<plataforma>.tar.gz
+# com um .sha256 ao lado.
+#
+#   scripts/package-cli.sh v1.3.2 linux-x86_64 x86_64-unknown-linux-gnu
+#
+# Plataformas: linux-x86_64 e linux-aarch64. O alvo diferente da máquina de
+# build usa o linker cruzado correspondente (gcc-x86-64-linux-gnu). Escreve os
+# arquivos na raiz do repositório e imprime os nomes.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+tag=${1:?uso: package-cli.sh <tag> <plataforma> <alvo-rust>}
+platform=${2:?uso: package-cli.sh <tag> <plataforma> <alvo-rust>}
+target=${3:?uso: package-cli.sh <tag> <plataforma> <alvo-rust>}
+
+if [ "$target" = x86_64-unknown-linux-gnu ] && [ "$(uname -m)" != x86_64 ]; then
+  export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc
+  export CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc
+fi
+
+rustup target add "$target" >/dev/null 2>&1 || true
+cargo build --release --locked -p guara-cli --target "$target"
+
+name="guara-${tag}-${platform}"
+rm -rf "$name"; mkdir "$name"
+cp "${CARGO_TARGET_DIR:-target}/${target}/release/guara" "$name/"
+cp README.md LICENSE-MIT LICENSE-APACHE "$name/"
+
+tar czf "$name.tar.gz" "$name"
+asset="$name.tar.gz"
+rm -rf "$name"
+sha256sum "$asset" > "$asset.sha256"
+echo "$asset"
+echo "$asset.sha256"