fix(ci): unsigned desktop build must disable updater artifacts

createUpdaterArtifacts:true (for release.yml's .sig signing) makes `tauri build`
demand TAURI_SIGNING_PRIVATE_KEY and fail without it — even though the .deb/.AppImage
built fine. Override it off for the unsigned per-commit build via
--config '{"bundle":{"createUpdaterArtifacts":false}}'. release.yml keeps signing.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/desktop-shell-tauri.md

@@ -183,3 +183,10 @@ The desktop bundle now runs in CI under **two distinct workflows** — keep the
   testing of the native shell, and catches a broken Tauri/Rust build early. Same system-deps + cargo
   cache as `release.yml`. The container images (`build-images.yml`) and the desktop installers are
   deliberately separate pipelines — the desktop app is **not** containerized ([[container-deployment]]).
+  - **Gotcha (the unsigned build still demands the key).** `tauri.conf.json` sets
+    `bundle.createUpdaterArtifacts: true` (so `release.yml` produces the `.sig` updater signatures).
+    With that on, `tauri build` **fails** if `TAURI_SIGNING_PRIVATE_KEY` is absent — *"A public key
+    has been found, but no private key"* — even though the `.deb`/`.AppImage` themselves built fine.
+    The unsigned CI build therefore overrides it off with
+    `--config '{"bundle":{"createUpdaterArtifacts":false}}'` (a JSON patch merged over the config),
+    so no `.sig` is attempted and no key is required. `release.yml` keeps the config default (signs).