feat(updater): add updater signing pubkey, build updater artifacts when key present

[ErikBjare]

Part of the updater-prerequisite work for ActivityWatch/activitywatch#1372 (see prerequisites in that PR's description) and #68.

Changes

• Set plugins.updater.pubkey to the new ActivityWatch updater signing public key. The matching private key + password are now configured as TAURI_SIGNING_PRIVATE_KEY / TAURI_SIGNING_PRIVATE_KEY_PASSWORD Actions secrets on ActivityWatch/activitywatch (where release builds run), and the key material is backed up offline.
• Enable bundle.createUpdaterArtifacts conditionally via --config in the Makefile, only when TAURI_SIGNING_PRIVATE_KEY is set. Committing createUpdaterArtifacts: true directly would make every tauri build fail without the signing key, breaking local builds and fork PRs (no secrets). With this approach, release CI (which has the secret) emits updater bundles + .sig files, while everything else builds plain bundles as before.

Notes

• The endpoint stays as-is (standard edition latest.json). The research-edition endpoint split from ci(release): publish Tauri updater latest.json on tag releases activitywatch#1372 still needs its own handling here — deferring that to @0xbrayo's release-line design.
• Pubkey is a minisign public key generated with tauri-cli 2.11.0; safe to commit (public by design).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[greptile-apps]

Greptile Summary

The PR configures the updater verification public key and makes updater artifact generation conditional on the signing key being available.

• Adds the ActivityWatch minisign public key to the Tauri updater configuration.
• Passes an inline Tauri configuration override from make build when TAURI_SIGNING_PRIVATE_KEY is set.
• Preserves unsigned local and fork builds when signing credentials are unavailable.

Confidence Score: 5/5

The PR appears safe to merge with no concrete blocking or independently actionable non-blocking issue identified.

The signing-dependent build override preserves ordinary builds without secrets, while the updater configuration supplies the public key required to verify signed release artifacts.

Important Files Changed

Filename	Overview
Makefile	Conditionally enables signed updater artifact generation while preserving the existing unsigned build path.
src-tauri/tauri.conf.json	Adds the updater signature-verification public key without changing the existing update endpoint.

_{Reviews (1): Last reviewed commit: "feat(updater): add updater signing pubke..." | Re-trigger Greptile}