### wai-quantum: Quantum Studio desktop installers, package-manager entries and signed updates

- **Installers** (`.github/workflows/wai-quantum-desktop-release.yml`, on a tag `wai-quantum-desktop-v<version>`):
  the desktop app (`wai/wai-quantum-desktop`, still 0.1.0) built on each runner and attached to the forge release
  with each asset's SHA-256, uploaded over the private network: a disk image for macOS on Apple silicon and Intel
  (with the GPU state vector); an AppImage, a Debian and an RPM package for Linux on x86_64 and arm64; an installer
  and a portable archive for Windows on x86_64. Each build runs what it made first: the bundled app's `check` and
  `update-status`, the macOS app's code signature and the disk image's checksums, the AppImage, and the Debian
  package unpacked. The tag must equal the version in both `Cargo.toml` and `tauri.conf.json`. The app gains
  `icons/icon.ico` and `icons/icon.icns`: a Windows build needs the `.ico` for its resource file, and the app had
  not been built on Windows before.
- **Package managers**: `release/manifests.py` writes a Homebrew cask (`wai-quantum-desktop`) and a Scoop manifest
  from the assets attached and their SHA-256 files, from templates beside it, and attaches them; nothing is pushed
  to the tap or the bucket. The cask says the app updates itself only when the release signed its updates, and
  says how to open an app signed ad hoc until one is notarised. `release/manifests_test.py` holds the script to
  releases made up here (every platform, none signed, one platform, none at all).
- **Updates**: a copy installed by its own installer (the macOS app, the AppImage, the packages, the Windows
  installer) asks the update manifest the website serves (`/quantum-studio-desktop/latest.json`) for a newer
  version as it opens, and
  the Studio offers it in a bar above the frame (`src/update.js`, its words in English and Chinese). It installs
  only when asked, and only an update whose signature verifies with the public key in `tauri.conf.json` and
  names the version announced (`requireSignedVersion`); the app then restarts into it. A copy built from source or
  unpacked by a package manager does not update itself, and its update check answers why. `wai-quantum-desktop
  verify-update FILE SIG VERSION` makes the same check, and the release runs it on every update it signs before
  attaching anything; `wai-quantum-desktop update-status` says which installer a copy came from, and the release
  and CI ask it of each copy (the app, the AppImage and the Debian package know their installer; a copy cargo
  built and the portable archive's know none, so they never update themselves). The release's last job writes
  `latest.json` from the update signatures and attaches it to the version's own release, which the website
  serves from when it is next deployed.
- **Signing is the owner's to switch on**: each step is skipped, and the log says so, while its forge secrets are
  absent. `WAI_QUANTUM_DESKTOP_UPDATER_KEY` (and its password) signs updates; until it is set, a release has
  installers and no update. The `APPLE_*` secrets sign the macOS app with a Developer ID and notarise it; until then
  it is signed ad hoc. The README gives the one command that makes the update key and every secret's name.
- **CI** (`wai-quantum-studio.yml`): the desktop app's tests, clippy and `check` now run on Linux (in the
  act-22.04 image, with the web view's libraries) and on Windows as well as on macOS, each leg requiring the update
  tests by name, and the Linux leg runs `release/manifests_test.py`; `test/update.test.mjs` (no browser) holds the
  update bar's logic. Dependencies added to the app: `tauri-plugin-updater` 2.14.0, with `minisign-verify` 0.3.0 and
  `base64` 0.22.1 used directly, both already in its tree.

