feat: harden updater release integrity (RURU-94)

[ruru-m07]

Summary

• add a Rust release validator that enforces exact stable/beta SemVer, expected targets and GitHub origins, production identity, immutable high-water rules, and Tauri Minisign verification for every updater artifact
• pin runtime updater endpoints and reject channel, version, target, asset, and URL-normalization mismatches before reporting or installing a candidate
• make manifest publication fail closed with serialized latest.json aggregation, unlocked artifact validation, attempt-preserving evidence, signed create-only history, durable revocations, compare-and-swap promotion, and public endpoint readback
• add an operator-gated stop-rollout workflow with revoked-fallback rejection, explicit legacy-sidecar migration, corrupt-pointer recovery, and immutable incident evidence
• document the forward-recovery process and the remaining native/paid trust boundary

Verification

• make verify
• cargo test -p updater-release (17/17)
• cargo clippy -p updater-release --all-targets -- -D warnings
• workflow YAML parsing and actionlint (excluding its known schema lag for GitHub's new concurrency.queue key)
• live 0.0.0-beta.7 manifest validation: 10 targets, 5 unique signed artifacts, 186,753,954 bytes, manifest SHA-256 edbf263c3ea74a7692d6eb8924ada207b2ce00689e00110be10dd6de7ac811e5

Scope

This is stacked on draft PR #133 / RURU-93 so it validates the intended Tauri 3 + CEF runtime. It deliberately does not claim native installed-update/relaunch qualification, Apple Developer ID/notarization, or Windows Authenticode/SmartScreen trust; those remain open in RURU-88.

Closes RURU-94

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying gitru with    Cloudflare Pages

Latest commit:	bc7960d
Status:	✅  Deploy successful!
Preview URL:	https://5896923a.gitru.pages.dev
Branch Preview URL:	https://ruru-ruru-94-updater-integri.gitru.pages.dev

View logs