release 1.3.2: update from Gitea, Linux-only CLI, desktop app for Linux and Windows

The updater reads latest.json from Gitea, built by scripts/make-latest-json.py
against the Gitea API (no gh CLI). Release workflow builds the Linux CLI and
the Linux+Windows desktop app, signs the updater artifacts and attaches
everything to the release.

Needs the repo secrets TAURI_SIGNING_PRIVATE_KEY and
TAURI_SIGNING_PRIVATE_KEY_PASSWORD, which I could not set (secret-store writes
are reserved for the user) - set them from ~/.tauri/guara-updater.key and
.pass before pushing a tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/release-upload.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Anexa arquivos a uma release do Gitea, trocando os de mesmo nome (assim uma
+# execução repetida do CI não falha por anexo duplicado).
+#
+#   API=https://git.exemplo.com/api/v1/repos/dono/repo TOKEN=... \
+#     scripts/release-upload.sh v1.2.3 arquivo1 arquivo2
+set -euo pipefail
+
+: "${API:?defina API (URL do repositório na API do Gitea)}"
+: "${TOKEN:?defina TOKEN}"
+tag=${1:?uso: release-upload.sh <tag> <arquivo>...}
+shift
+
+auth=(-H "Authorization: token $TOKEN")
+id=$(curl -fsS "${auth[@]}" "$API/releases/tags/$tag" | jq -r .id)
+
+for file in "$@"; do
+  name=$(basename "$file")
+  for old in $(curl -fsS "${auth[@]}" "$API/releases/$id/assets" | jq -r --arg n "$name" '.[] | select(.name == $n) | .id'); do
+    curl -fsS -X DELETE "${auth[@]}" "$API/releases/$id/assets/$old"
+  done
+  curl -fsS -X POST "${auth[@]}" -F "attachment=@$file" "$API/releases/$id/assets?name=$name" >/dev/null
+  echo "enviado: $name"
+done