fix(release): latest.json entry per installer type — .deb booths could never self-update

tauri-plugin-updater resolves the download target as {os}-{arch}-{installer}
first (linux-x86_64-deb — the bundler stamps the installer type into the
binary, verified with `strings` on a local .deb) and only then bare
linux-x86_64. Our manifest carried only the bare key, pointing at the
AppImage. A .deb install therefore downloaded the AppImage, verified its
signature, then failed install_deb()'s is_deb check with
InvalidUpdaterFormat — after the download, before any relaunch. This, not
version drift or swallowed errors, is why v0.1.0→v0.1.6 never self-updated.

latest.json now carries linux-x86_64-deb, linux-x86_64-rpm (when built) and
linux-x86_64 (AppImage), each with its own .sig. A .deb update ends in a
polkit password prompt (pkexec dpkg -i) — the intended admin gate on a
root-installed package. README + wiki updated; wiki also records the v0.1.6
LIVE field verification.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/log.md

@@ -2860,3 +2860,16 @@ uses the unauthenticated /health (extended with app: "parking-system") instead o
 plugin does set Origin itself, the http-scope "quirk" is URLPattern default-port semantics) and
 added a local-AppImage pre-tag gate to the desktop README, since tauri dev cannot reproduce any
 of these origin-dependent bugs. Full detail on [[desktop-shell-tauri]].
+
+## [2026-09-04] fix | Desktop in-app update never worked: latest.json described only the AppImage, booths run the .deb
+
+tauri-plugin-updater looks up `{os}-{arch}-{installer}` first (linux-x86_64-deb — the bundler
+stamps the installer type into the binary; verified with strings on a local .deb) and only then
+bare linux-x86_64. release.yml's latest.json carried only the bare key → the AppImage, so every
+.deb install downloaded the AppImage, passed signature verification, then failed install_deb()'s
+is_deb check with InvalidUpdaterFormat — invisible until v0.1.6 fixed the desktop log channel.
+This, not version drift or swallowed errors, is why v0.1.0→…→v0.1.6 never self-updated.
+latest.json now has one signed entry per installer (deb, rpm, AppImage); a .deb update ends in a
+polkit password prompt (pkexec dpkg -i), which is the intended admin gate on a root-installed
+package. README + [[desktop-shell-tauri]] updated. First real test: tag v0.1.7 and accept the
+prompt on the v0.1.6 booth.