DayApp v0.3.14

Changes

• publish's verify globbed windows-setup/… and linux-appimage/… without the dist/ prefix the download-artifact step lays them under — the .sig globs in the generate step carried it, the exe globs in the verify step didn't, so the artifact set was proven complete only for the manifest and blind for the verifier
• release.yml's re-sign died: tauri signer sign decodes TAURI_SIGNING_PRIVATE_KEY as the key's base64 content, while the bundler accepts a file path in the same var — feeding it the path put /home/runner/work/_temp/… through a base64 decoder (Invalid symbol 95 = the underscore). Hand the signer the file's contents instead; the strip itself verified clean
• the update channel goes all-platform: latest.json now carries windows-x86_64 and linux-x86_64 beside darwin-aarch64, so the header update icon and ⌘P update flow work everywhere the app installs (the updater plugin and its poll were already cross-platform — the channel just had nobody to serve). release.yml gains a linux job on ubuntu-22.04 (the dev builds' glibc 2.35 base) building the signed AppImage: the strip rewrites the file after the bundler's signing pass, so the artifact is re-signed via tauri signer sign and the shipped signature covers the shipped bytes; the windows job builds through the release config too — createUpdaterArtifacts signs the NSIS installer the updater runs. latest.json generation and the signature verify move to the publish job where every platform's artifacts are in one place, each entry asserted against its .sig and the embedded file: name; the install-path gate grew to all three installers (install.sh for macOS + Linux, install.ps1 for Windows — all resolve the versioned channel, never the dev tags, or updates fork between lineages). The strip/repack/mode-normalize lives in scripts/appimage-strip.sh now, shared with linux.yml whose inline copy is deleted. install.sh's Linux path flips from the rolling linux-dev tag to releases/latest — the flip its own comment was waiting for: fresh installs land on the updater-capable lineage and the in-app updater takes over (it replaces the AppImage at the running path, so install.sh's ~/.local/bin placement keeps working). README's Linux badge and download door follow the same versioned channel. v0.3.14
• the AppImage catalog's test sandbox execs the AppImage tree as a plain user, and linuxdeploy's prebuilt AppRun launcher sits inside at 0770 root:root — a real FUSE mount remaps uid so nothing ever showed (0.3.9 ran on the Omarchy test box), but the catalog's firejail run died with Permission denied before AppRun could even start (their diagnose.sh carries a literal rule for this Tauri/linuxdeploy quirk). Normalize the extracted tree to a+rX (a+x on AppRun/AppRun.wrapped) before the repack — a no-op for real users, executable everywhere else; catalog PR AppImage/appimage.github.io#10304 gets a /retest once linux-dev refreshes
• release notes picked the wrong previous tag: the rolling linux-dev/windows-dev prerelease tags sort above vN.N.N in --sort=-v:refname, so head -1 chose windows-dev and the walk narrowed to the last push — only the version-bump commit remained, the filter dropped it, and v0.3.13 shipped reading 'initial release'. The selection now greps to version tags before head -1 (flaw inherited verbatim from release.sh; it never showed because the rolling tags are new and the last releases all carried custom NOTES). v0.3.13's notes edited in place with the real range