Add signed cross-platform update installation

[enaboapps]

Context

The Rust/Tauri app currently checks whether an update exists but cannot download, install, retry, restart, or report progress. Its updater endpoint and signing key are also unconfigured. The archived C# app provided automatic checks and one-click installer application (see #445 and switchify-pc-legacy).

Required behavior

• Configure a signed Tauri updater feed through the release pipeline without committing private signing material.
• Support Windows and macOS update artifacts.
• Check automatically at startup and on a recurring schedule while retaining manual checks.
• Expose available, downloading, ready-to-install, applying, current, and failed states.
• Show download progress and allow retry after download or installer-launch failures.
• Install the update and restart when required.
• Deduplicate concurrent checks and installs.

Acceptance criteria

• Signed Windows and macOS artifacts can be discovered by a packaged app.
• Users can check, download, install, and restart from the app.
• Automatic checks do not overlap or interrupt installation.
• Progress and actionable failures are accessible.
• Unpackaged or unconfigured builds fail clearly without crashing.
• Rust tests cover transitions, retry, cancellation, and concurrency.
• Release configuration is validated in CI.

[enaboapps]

Implementation preparation is in draft PR #547. The updater lifecycle, accessible progress/retry/cancel/install UI, release-only configuration, artifact/feed generation, and credential gates are implemented and under CI/Greptile review.

This issue remains open pending external release configuration and one end-to-end signed beta validation:

• TAURI_UPDATER_PUBLIC_KEY plus updater private-key secrets
• Apple Developer ID certificate, notarization credentials, and signing identity
• a current self-hosted Windows switchify-release runner with SimplySign/Certum available
• publishing and installing one real signed macOS and Windows beta

No C# v0.10.0 release asset or feed has been changed.

[enaboapps]

v1.0.0-alpha.1 has now been published as the signed baseline prerelease: https://github.com/switchifyapp/switchify-pc/releases/tag/v1.0.0-alpha.1

Verified release evidence:

• source/tag versions match 1.0.0-alpha.1
• macOS Developer ID signing, notarization, stapling, package verification, and updater artifact signing passed
• Windows Certum signing, UIAccess package verification, checksum publication, and updater artifact signing passed
• the published feed contains signed darwin-aarch64 and windows-x86_64 entries for the release
• the Windows installer checksum and Authenticode signature were independently verified
• the packaged Windows app was installed and launched, displayed v1.0.0-alpha.1, and reported that Switchify PC is up to date

The implementation/test-backed acceptance criteria are checked above. The issue remains open in milestone v1.0.0-beta.1 because a real signed Alpha-to-Beta check/download/install/restart has not yet been exercised on both Windows and macOS.

[enaboapps]

Windows Alpha updater evidence for v1.0.0-alpha.2:

• Release: https://github.com/switchifyapp/switchify-pc/releases/tag/v1.0.0-alpha.2 (published as a prerelease)
• Release workflow 31400806790 passed source validation, macOS Developer ID signing/notarization/stapling, Windows Certum signing, updater-signature verification, asset publication, and feed publication.
• Both published updater URLs now resolve successfully after Fix updater feed release asset URLs #563 fixed GitHub's release-asset filename normalization; the feed retains signed darwin-aarch64 and windows-x86_64 entries for 1.0.0-alpha.2.
• The Windows installer checksum matches SHA256SUMS-windows.txt and its Authenticode signature is valid.
• A packaged v1.0.0-alpha.1 app discovered v1.0.0-alpha.2, downloaded it through the in-app updater, reached ready-to-install, installed/restarted, and now runs the signed v1.0.0-alpha.2 binary. Sanitized runtime diagnostics record updater status current after restart.

The first two acceptance criteria remain unchecked because this proves the real signed update path on Windows, not yet on macOS. The issue stays open in v1.0.0-beta.1 for the remaining cross-platform Alpha-to-Beta proof.

[enaboapps]

Alpha 3 bootstrap-repair release evidence:

• The original packaged macOS Alpha 1 client discovered and downloaded the signed update but installation failed with “The macOS runtime is not initialized.” The supplied photo captures that failure.
• PR Fix macOS updater cleanup dispatch #565 fixed the thread-affinity defect by awaiting platform disconnect cleanup on the macOS main thread before updater installation while preserving deterministic cleanup and retry state.
• v1.0.0-alpha.3 is published as a prerelease: https://github.com/switchifyapp/switchify-pc/releases/tag/v1.0.0-alpha.3
• Release workflow 31414041113 passed validation, macOS signing/notarization/stapling, Windows Certum signing, updater-signature verification, seven-asset publication, and feed publication.
• The live feed reports 1.0.0-alpha.3, contains signed darwin-aarch64 and windows-x86_64 entries, and both dot-normalized asset URLs resolve successfully.
• The downloaded Alpha 3 Windows installer matches the published SHA256 checksum and has a valid Authenticode signature.

The signed cross-platform discovery acceptance criterion is now proven and checked. The install/restart criterion remains open: Alpha 3 must be installed manually from the notarized DMG on macOS because Alpha 1/2 cannot bootstrap the fix through their broken updater, and a newer release is required to prove the repaired macOS in-app install path. Issue #532 remains open in v1.0.0-beta.1.