Fix updater feed release asset URLs

[enaboapps]

Closes #562

Summary

• normalize spaces to dots when constructing GitHub release asset URLs
• cover production-style local artifact filenames with a regression test
• restore packaged updater downloads from the published feed

Validation

• Node.js 24.13.0; Rust 1.97.1
• npm run lint
• npm test (55 frontend tests and 5 updater-feed tests)
• npm run build
• cargo fmt --manifest-path src-tauri/Cargo.toml --check
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• cargo test --manifest-path src-tauri/Cargo.toml (129 unit tests and 2 configuration tests)

Release evidence

The v1.0.0-alpha.2 feed URL using Switchify%20PC returned HTTP 404, while the GitHub-normalized Switchify.PC release asset exists and its downloaded checksum and Authenticode signature both verify. After merge, the existing immutable tag will be rerun through workflow_dispatch and verified with a packaged Alpha 1 to Alpha 2 update.

[greptile-apps]

Greptile Summary

This change updates updater-feed download URLs so GitHub release assets created from filenames containing spaces are addressed by their dot-normalized names. macOS and Windows artifacts with local filenames containing spaces were exercised: the generated URLs use the expected dot-normalized asset names, while signature verification continues to use the unchanged local artifact and .sig paths. The focused updater-feed test suite completed successfully with all five tests passing.

Confidence Score: 5/5

Safe to merge: the updater URLs now match GitHub’s release-asset naming behavior without changing local artifact discovery or signature verification.

Direct execution covered both macOS and Windows artifacts whose filenames contain spaces, verified the generated URLs and verifier arguments, and confirmed the focused updater-feed tests pass.

Files Needing Attention: No additional files need attention. The reviewed behavior is confined to scripts/create-update-feed.mjs and its focused Node tests.

T-Rex Logs

What T-Rex did

• I ran a plain Node harness with valid macOS gzip and Windows PE artifacts whose local filenames contain spaces, and observed that the updated implementation emitted dot-normalized Switchify.PC... release asset names for both platforms while the verifier still used the original artifact and .sig inputs with spaces, with all five tests passing.
• I validated the URL normalization aligns with GitHub release-assets behavior: before the PR the URLs used %20 for spaces, after the PR the names are dot-normalized, yet the local artifact inputs (including spaces in .sig paths) remain unchanged for verification.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Fix GitHub release asset URLs in updater..." | Re-trigger Greptile}