fix(desktop): mirror signed releases to public repo for the updater

The updater endpoint pointed at mca/parking_solution's own Gitea "latest
release" redirect, but that repo is private and field appliances have no
Gitea credentials — every update check was silently failing. release.yml
now mirrors signed installers to mca/public_releases (public, installers
only) under a fixed desktop-latest tag; tauri.conf.json points there.
Rejected embedding a read token in the app instead, given the booth-operator
threat model.

Also: make the appliance-provisioning root_directory gotcha impossible to
skim past (boxed callout + explicit next-step pointers), after it caused a
second missed step on the park-2 install.

wiki/decisions/appliance-provisioning.md

@@ -2,7 +2,7 @@
 type: reference
 tags: [parking, deployment, appliance, hardening, runbook, offline-first]
 sources: []
-updated: 2026-08-30
+updated: 2026-09-02
 status: settled
 ---
 
@@ -290,19 +290,30 @@ sudo loginctl enable-linger admin     # so the user service starts at boot witho
   NOT `:9120` — Core's container port `9120` is exposed-not-published; the agent reaches it through
   the proxy. (Gotcha #7 below.)
 - Config lands at `~/.config/komodo/periphery.config.toml`. The key field is **`core_address`**
-  (singular); `root_directory` must be a path `admin` can write. **⚠ VERIFY THIS after install —
-  Periphery v2.2.0's installer writes `root_directory = "/etc/komodo"` even with `--user`**
-  (bit the lab box 2026-07-07: panic `Failed to write private key pem to "/etc/komodo/keys/
-  periphery.key" … Permission denied`, crash-loop until systemd gives up). Fix + restart:
-  ```bash
-  sed -i 's|^root_directory = .*|root_directory = "'"$HOME"'/.komodo"|' ~/.config/komodo/periphery.config.toml
-  systemctl --user reset-failed periphery && systemctl --user restart periphery
-  ```
-  NB `sudo systemctl restart periphery` says *unit not found* — it's a USER unit; always
-  `systemctl --user …`. The onboarding key survives a pre-connect crash (unused until first dial).
+  (singular).
 
-Verify: `systemctl --user status periphery` → active; the server **`park-buzi`** appears and goes
-**OK/green** in Core → Servers. Then **delete the onboarding key**.
+> ⚠ **ALWAYS CHECK THIS — every install so far has hit it (lab box 2026-07-07, booth `park-2`
+> 2026-09-02).** `root_directory` must be a path `admin` can write, but **Periphery's installer
+> writes `root_directory = "/etc/komodo"` even with `--user`** (still true as of v2.3.3). Result:
+> panic `Failed to write private key pem to "/etc/komodo/keys/periphery.key" … Permission denied`,
+> crash-loop until systemd gives up (`Start request repeated too quickly`).
+>
+> **Fix + restart:**
+> ```bash
+> sed -i 's|^root_directory = .*|root_directory = "'"$HOME"'/.komodo"|' ~/.config/komodo/periphery.config.toml
+> systemctl --user reset-failed periphery && systemctl --user restart periphery
+> ```
+> NB `sudo systemctl restart periphery` says *unit not found* — it's a USER unit; always
+> `systemctl --user …`. The onboarding key survives a pre-connect crash (unused until first dial).
+>
+> **➜ Do not stop here once it's green.** This fix only gets Periphery *running* — the Stack still
+> isn't deployed. Immediately continue to **verify below, then §7b**.
+
+**Verify:** `systemctl --user status periphery` → active; the server **`park-buzi`** appears and
+goes **OK/green** in Core → Servers. Then **delete the onboarding key**.
+
+**➜ Next step is §7b below — the Stack itself is not deployed yet.** A green Server in Core just
+means the agent connected; it runs nothing until you add the Registry/Git accounts and deploy.
 
 ### 7b. Deploy the Stack (in Core — by hand once, then code)
 
@@ -485,7 +496,11 @@ works; the desktop app is a separate workstream.
    separate Komodo credentials. A blank registry account on the Stack → anonymous pull →
    `no basic auth credentials`. Set the Stack's **Registry Account** (`komodo`).
 9. **User-mode Periphery + `/etc/komodo` `root_directory` = `Permission denied`** writing the agent
-   key. User-mode (runs as `admin`, no root daemon) must keep `root_directory` under `$HOME`.
+   key. User-mode (runs as `admin`, no root daemon) must keep `root_directory` under `$HOME`. Hit
+   on every install so far (lab box 2026-07-07, booth `park-2` 2026-09-02, still on v2.3.3) —
+   **check this first** whenever a fresh Periphery install crash-loops; see the boxed callout in
+   §7a for the fix. Easy to fix-and-move-on without realizing the Stack still isn't deployed —
+   §7a's fix only starts the agent, §7b deploys the Stack.
 10. The config key is **`core_address`** (singular). And `--core-address` derives `wss://` from
     `https://` — if Core were plain-HTTP you'd need `http://` (→ `ws://`).
 11. ResourceSync **Execute disabled + file shown clean in Info = empty diff = already in sync**