fix: publish updater manifest with public download URLs

[11suixing11]

Fixes #124.

What changed

• Add a small release-tooling script that rewrites generated latest.json platform URLs from GitHub REST release asset API endpoints to the matching public releases/download URLs.
• Run that normalization in the publish-release job before the draft release is made public, then re-upload latest.json with --clobber.
• Leave unsigned/manual releases alone when no latest.json asset exists.
• Add focused coverage for duplicate platform entries, missing asset mappings, and the GitHub API release object shape.
• Add a release-checklist reminder to verify updater manifest URL shape after tagging.

Why

Tauri's generated updater manifest can point package URLs at https://api.github.com/repos/.../releases/assets/<id>. Installed clients fetch those URLs without a token, so a shared public IP can exhaust GitHub's unauthenticated REST API quota and make update installation fail with HTTP 403 even though the public release asset itself is still downloadable.

Keeping the manifest on public https://github.com/.../releases/download/... URLs avoids the REST API quota path and fixes the release pipeline instead of requiring a client token or hiding the updater error.

Verification

• node --test tests/normalize-latest-json.test.mjs
• Dry run against the current public v1.7.1 release manifest and asset list: normalized 11 platform URLs, 0 api.github.com REST asset URLs remaining, 11 public release download URLs
• node --check scripts/normalize-latest-json.mjs && node --check tests/normalize-latest-json.test.mjs
• bun test
• bun run build
• bunx tsc --noEmit
• git diff --check

Not run locally: cargo check --release because this machine does not have a Rust toolchain installed; this PR does not change Rust code.

[mattenarle10]

Reviewed the release normalization workflow and focused tests. Local validation passed; approving for merge.