v1.0.1

fix(release): swap in an updater key we actually hold the password to

The v1.0.1 run bundled the installer fine and then died signing the
updater artifact: the private key and the password secret disagreed.
Regenerated the pair so both halves are known, and pointed the config
at the new public key. No shipped release carried the old one, so
nothing in the wild verifies against it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYR5bMhvhfigzGKote7nbZ