Release build & publish (unsigned Windows): tag gate pass → tauri bundle → prerelease GitHub Release

[Zlyzart]

Summary

Sibling of #60 (the split). #60 adds the tag-triggered test job that runs the full CI surface on a v* push and auto-files a failure issue on red. This issue adds the release job (needs: test) to the same .github/workflows/release.yml: on a green tag, build the Windows desktop bundle and publish a prerelease GitHub Release with the installer attached.

Tauri bundling is currently disabled (src-tauri/tauri.conf.json → bundle.active = false); enabling it for the release build only — without flipping the global flag — is part of this work. Versions are currently 0.1.0 in both src-tauri/tauri.conf.json and src-tauri/Cargo.toml.

Behaviour (release job, needs: test)

• Version check (fail fast): assert the pushed tag (stripped of leading v) equals the version in src-tauri/tauri.conf.json and the package version in src-tauri/Cargo.toml. Fail the job on mismatch so a mistagged release can't ship.
• Build the bundle: produce the Windows installer via tauri build. Because bundle.active is false for dev/CI, enable bundling for the release build only — e.g. a tauri build --config overlay or --bundles msi,nsis — without flipping the global flag (keeps the PR Desktop app gate an unbundled compile).
• Publish: create a GitHub Release marked prerelease with auto-generated notes (merged PRs since the previous tag) and the .msi/.exe attached. Job needs contents: write.
• Unsigned for now: ship the installer unsigned (users see a SmartScreen warning). Code signing is a separate blocked follow-up (below).

Acceptance criteria

• On a passing test job (Release pipeline (unsigned): tag-triggered test gate → auto-file failure issue or publish Windows release #60), the release job runs (needs: test).
• The job fails fast if the tag ≠ tauri.conf.json/Cargo.toml version.
• A passing run publishes a prerelease GitHub Release with auto-generated notes and the Windows installer attached.
• The release build enables bundling without a global bundle.active flip; the PR-time Desktop app gate still builds unbundled.
• contents: write is scoped to the release job only.
• Gate guard stays green.

Out of scope / follow-ups

• Code signing (blocked): sign the installer once a code-signing cert is obtained. Track as type:feature + area:ci + status:blocked. Leading OSS option: SignPath.io (free for OSS, GH Actions integration, HSM key storage); alternative Azure Trusted Signing (~$10/mo).
• macOS / Linux release targets (Windows-only for now).
• Automated version bumping (this pipeline verifies, it does not bump).

File map

• Touch: .github/workflows/release.yml — add the release job (needs: test).
• Touch: src-tauri/tauri.conf.json — release-bundling config (overlay or flag), not the global active.

Depends on #60.

[github-actions]

Acceptance criteria

• release job is added to .github/workflows/release.yml with needs: test (gating on the Release pipeline (unsigned): tag-triggered test gate → auto-file failure issue or publish Windows release #60 test job).
• The job fails fast if the pushed tag (sans leading v) does not match the version field in both src-tauri/tauri.conf.json and src-tauri/Cargo.toml.
• Bundling is enabled for the release build only (e.g. via tauri build --config overlay or --bundles msi,nsis); the global bundle.active = false flag in src-tauri/tauri.conf.json is left unchanged so the PR-time Desktop app gate continues to build unbundled.
• A passing run creates a prerelease GitHub Release with auto-generated notes (merged PRs since the previous tag) and the Windows installer (.msi/.exe) attached.
• contents: write permission is scoped to the release job only (not granted to the whole workflow).
• Gate guard (scripts/gate-guard.sh origin/trunk) stays green — no tests removed or weakened.
• The release is unsigned (SmartScreen warning is acceptable; code signing is a follow-up).

A human should apply status:ready to authorize implementation (and may adjust the proposed complexity:opus label first).