feat(gui): in-app auto-updater via tauri-plugin-updater

[GregTheGreek]

Summary

Wires up the Tauri 2 in-app updater so an installed rompatch app
self-checks against GitHub Releases on launch and offers to install +
restart on the next version. Out of scope: CLI distribution, crates.io
publishing, version-bumping automation. Tags are still cut manually.

What's in here

Rust side

• crates/rompatch-gui/Cargo.toml - add tauri-plugin-updater = "=2.10.1" + tauri-plugin-process = "=2.3.1"
• crates/rompatch-gui/src/lib.rs - register both plugins on the builder
• crates/rompatch-gui/tauri.conf.json
  • bundle.createUpdaterArtifacts: true so each build emits .app.tar.gz + .sig
  • plugins.updater block with the pubkey placeholder + endpoint pointing at releases/latest/download/latest.json (GitHub redirects this URL to whichever release is marked latest)
  • removed the hardcoded "version": "0.1.0" so Tauri reads from the workspace Cargo.toml (single source of truth)
• crates/rompatch-gui/capabilities/default.json - grant updater:default + process:allow-restart

Frontend

• ui/package.json - @tauri-apps/plugin-updater@2.10.1 + @tauri-apps/plugin-process@2.3.1
• ui/src/lib/updater.ts - small useUpdater hook that wraps check() and exposes download progress
• ui/src/components/UpdateBanner.tsx - banner at the top of the main panel with an Install + restart button
• ui/src/App.tsx - mount the banner

CI (.github/workflows/ci.yml gui job)

• Pass TAURI_SIGNING_PRIVATE_KEY + TAURI_SIGNING_PRIVATE_KEY_PASSWORD to both tauri build steps
• New step builds latest.json from the signature file
• Attach .app.tar.gz, .app.tar.gz.sig, and latest.json to the GitHub Release
• Extend the sigstore attestation subject-path to cover the tarball

Required setup before the first release after merge

Important

The current pubkey in tauri.conf.json is a placeholder. CI will fail on the first tag push until the steps below are done. Generate the keypair locally, commit the real pubkey, and add the two secrets - then tag.

1. Generate the Tauri ed25519 keypair locally:

   cargo install tauri-cli --version 2.11.1 --locked   # if not already installed
   cargo tauri signer generate -w ~/.tauri/rompatch.key

   • Stash the password in 1Password.
2. Add two repo secrets at https://github.com/GregTheGreek/rompatch-rs/settings/secrets/actions:
   • TAURI_SIGNING_PRIVATE_KEY = full contents of ~/.tauri/rompatch.key
   • TAURI_SIGNING_PRIVATE_KEY_PASSWORD = the password chosen above
3. Replace REPLACE_WITH_TAURI_UPDATER_PUBLIC_KEY in crates/rompatch-gui/tauri.conf.json with the public key printed by step 1.
4. Commit + push, then merge this PR.
5. Push a tag like v0.2.0 - the existing gui job will build the signed updater artifacts and attach everything to the release.

Risks / gotchas

• The Tauri signing key is separate from the Apple Developer ID cert. Two signing systems run in parallel: Apple signs the .app for Gatekeeper, Tauri signs the .app.tar.gz for the in-app updater. Both are required for a smooth post-install launch.
• Apple signing must stay on for releases users will update from. If a tag is cut from the unsigned fallback path, the post-update .app will be Gatekeeper-quarantined and silently fail to launch.
• The public key is embedded in the binary. Rotating it requires shipping a release through the old key first (or asking users to re-download). Pick once, back up the key file.

Test plan

• cargo check -p rompatch-gui --release - clean
• cargo clippy -p rompatch-gui --all-targets -- -D warnings - clean
• cargo fmt --all -- --check - clean
• pnpm typecheck - clean
• cargo tauri info - resolves both new plugins (Rust + JS sides)
• After secrets + real pubkey land: tag v0.2.0, confirm .app.tar.gz, .app.tar.gz.sig, and latest.json attach to the release
• Install the prior version .dmg, launch the v0.2.0-aware build, confirm the banner appears and Install & restart downloads + relaunches