The release has been blocked on one secret for a while, and the only thing on
offer was "wait". This adds a second path: a build with updater artifacts turned
off, which needs no key at all.

What it costs is stated in three places, because somebody scanning a releases
page reads the badge and not the body. The notes lead with it — anything
installed from this build stays on that version until it is uninstalled and
replaced by hand. The release is named "unsigned preview". It is marked as a
prerelease, so the badge says so too.

The two builds are separate steps rather than one step with conditions inside
it. The difference between them is *what they produce*, and burying that in an
expression is how somebody ships an unsigned build believing it was signed.

The guard that stops a signed release without a key stays exactly as it was for
the normal path, and is skipped only when the unsigned build is asked for
explicitly, by ticking a box on a manual run. Nothing about a tag push changes.

This is a worse product than a signed release and it should stay the exception.
An application that cannot deliver its own security fixes is one whose users
have to be told, individually, to go and get the next one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>