fix(release): repair server-asset signing and old-fleet update compatibility

Three latent bugs in the never-exercised publish path:

- `tauri signer sign -k` loads the key from a *string*; we passed the mktemp
  path, so the CLI base64-decoded "/tmp/tmp.XXXX" and died with "Invalid
  symbol 46, offset 8" (the dot). Use `-f` (key from file). The stored secret
  was never read and never at fault.
- checksums.sha256 lines carried "windows/"/"linux/" path prefixes; the
  v1.0.0 updater's ParseChecksumFile exact-matches the last field against
  "chatserver.exe", so every deployed 1.0.0 server would have failed the
  checksum lookup. Emit bare asset filenames (current updater accepts both).
- No end-to-end proof the signed assets verify against the pinned public key
  that ships inside the server binary. Add a fail-closed minisign verify step
  before any release is created; it catches key/pubkey mismatch, signature
  format drift, and signer flag regressions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -369,9 +369,14 @@ jobs:
           git archive --format=tar.gz --prefix="OwnCord-${VERSION}/" \
             -o "owncord-src-${{ github.ref_name }}.tar.gz" HEAD
 
+      # Checksum lines must use bare asset filenames: the v1.0.0 updater's
+      # ParseChecksumFile does an exact match on the last field, so a
+      # "windows/" prefix would strand every deployed server on 1.0.0.
       - name: Generate SHA256 checksums
+        shell: bash
         run: |
-          find windows linux -type f -exec sha256sum {} \; > checksums.sha256
+          (cd windows && sha256sum *) > checksums.sha256
+          (cd linux && sha256sum *) >> checksums.sha256
           sha256sum owncord-src-*.tar.gz >> checksums.sha256
 
       - name: Generate server update manifest
@@ -391,8 +396,22 @@ jobs:
           printf '%s' "$SERVER_UPDATE_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
           trap 'rm -f "$KEY_PATH"' EXIT
           npm ci
-          npx tauri signer sign -k "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/chatserver.exe
-          npx tauri signer sign -k "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/server-update-manifest.json
+          npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/chatserver.exe
+          npx tauri signer sign -f "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/server-update-manifest.json
+
+      # Fail closed before publishing: prove the freshly signed assets verify
+      # against the pinned public key that ships inside the server binary.
+      # Catches key/pubkey mismatch, signature format drift, and signer flag
+      # regressions — each of which has silently broken this pipeline before.
+      - name: Verify signed assets against pinned server update key
+        shell: bash
+        run: |
+          sudo apt-get update && sudo apt-get install -y minisign
+          base64 -d Server/updater/server_update_public_key.txt > "$RUNNER_TEMP/server_update.pub"
+          for f in windows/chatserver.exe windows/server-update-manifest.json; do
+            base64 -d "$f.sig" > "$RUNNER_TEMP/asset.minisig"
+            minisign -Vm "$f" -x "$RUNNER_TEMP/asset.minisig" -p "$RUNNER_TEMP/server_update.pub"
+          done
 
       - name: Install root dependencies (changelogen)
         run: npm ci