Desktop: add stable Tauri updater channel and signed updater manifest

[justn-hyeok]

Context

The v0.1.0 Desktop DMG does not enable a Tauri updater channel. RC updater JSON remains scoped to RC lines only.

Acceptance criteria

• Stable Desktop builds produce updater app artifacts.
• Stable updater manifest is generated for the stable channel.
• Updater signatures validate with the release public key.
• Installed stable app discovers only compatible stable updates.
• Release evidence includes updater artifact SHA, manifest URL, signature validation output, and negative checks for wrong-channel updates.