Fix updater signing for unencrypted keys

[loadchange]

Summary

• allow the existing unencrypted Tauri updater key to use its valid empty password
• retain the real signer preflight and all private-key/Apple credential checks
• bump the native macOS release version to 2.0.2
• add a release-pipeline regression guard

Why

Release run 33645315405 built the native universal macOS app successfully, then failed before signing because the workflow incorrectly required TAURI_SIGNING_PRIVATE_KEY_PASSWORD to be non-empty. Tauri explicitly supports unencrypted private keys with an empty password. No release assets were published.

Verification

• npm test
• cargo test --locked --lib --manifest-path src-tauri/Cargo.toml (208 passed, 4 ignored)
• Tauri CLI 2.11.3 empty-password generate/sign preflight
• actionlint .github/workflows/release.yml
• bash -n native/Scripts/package-native-release.sh
• node scripts/release-version.js check 2.0.2
• git diff --check