fix(updater): make client auto-update work end-to-end and Linux server self-update verifiable

- client: update endpoint now sends {{target}}-{{arch}}-{{bundle_type}} so the
  server-echoed platforms key matches the updater plugin's
  {os}-{arch}-{installer} lookup (previously bare {{target}} produced a key
  the plugin never matches, so no update was ever surfaced)
- client: TOFU cert pin is scoped to the OwnCord server host via
  HostScopedVerifier; the GitHub installer download validates against web PKI
  instead of failing the pinned-fingerprint check on every install
- client: check/install share one build_updater helper so the two paths cannot
  diverge; tauri-plugin-updater minor-pinned per its configure_client guidance
- server: client-update endpoint serves target-specific artifacts (NSIS,
  per-arch AppImage) and returns 204 for targets without a published updater
  artifact (deb, darwin) instead of always serving the Windows NSIS installer
- release: server-update-manifest.json now binds both OS assets (legacy
  top-level pair kept pointing at the Windows binary so deployed servers still
  verify); VerifyReleaseManifest resolves the entry matching the downloaded
  asset, fixing Linux server self-update
- release: ARM64 staging renames installer, tar.gz and .sig consistently so
  signatures keep pairing and arch-less names cannot collide with x86_64 assets
- ci: run cargo test --lib (Rust #[cfg(test)] code was never compiled in CI);
  merge the two ptt tests that raced on the global PTT_VKEY atomic

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -270,6 +270,12 @@ jobs:
         working-directory: Client/tauri-client/src-tauri/
         run: cargo clippy -- -D warnings
 
+      # Without this, #[cfg(test)] code is never compiled or run in CI
+      # (clippy above skips test targets), so Rust unit tests would rot.
+      - name: Rust unit tests
+        working-directory: Client/tauri-client/src-tauri/
+        run: cargo test --lib
+
       - name: Security audit (Rust dependencies)
         working-directory: Client/tauri-client/src-tauri/
         run: |

.github/workflows/release.yml

@@ -237,20 +237,18 @@ jobs:
         run: |
           mkdir -p linux-arm64-staging
           BUNDLE_DIR="Client/tauri-client/src-tauri/target/release/bundle"
-          # AppImage (ensure arch is in filename)
-          for f in "$BUNDLE_DIR"/appimage/*.AppImage; do
+          # AppImage + updater artifact (.tar.gz) + signatures. Every filename
+          # must carry the arch: FindClientAssets matches on the
+          # _aarch64.AppImage.tar.gz suffix, and arch-less names would collide
+          # with the x86_64 assets when both artifact sets are downloaded into
+          # the same linux/ directory at publish time. Inserting _aarch64
+          # before ".AppImage" renames installer, tar.gz, and .sig
+          # consistently, so signatures keep pairing with their artifacts.
+          for f in "$BUNDLE_DIR"/appimage/*.AppImage "$BUNDLE_DIR"/appimage/*.AppImage.tar.gz "$BUNDLE_DIR"/appimage/*.sig; do
             [ -f "$f" ] || continue
-            [[ "$f" == *.sig ]] && continue
-            dest="linux-arm64-staging/$(basename "$f")"
-            # Append _aarch64 if bundler omits arch from filename
-            [[ "$(basename "$f")" == *aarch64* ]] || dest="${dest%.AppImage}_aarch64.AppImage"
-            cp "$f" "$dest"
-          done
-          for f in "$BUNDLE_DIR"/appimage/*.AppImage.tar.gz; do
-            [ -f "$f" ] && cp "$f" linux-arm64-staging/
-          done
-          for f in "$BUNDLE_DIR"/appimage/*.sig; do
-            [ -f "$f" ] && cp "$f" linux-arm64-staging/
+            base="$(basename "$f")"
+            [[ "$base" == *aarch64* ]] || base="${base/.AppImage/_aarch64.AppImage}"
+            cp "$f" "linux-arm64-staging/$base"
           done
           # .deb
           for f in "$BUNDLE_DIR"/deb/*.deb; do
@@ -376,11 +374,17 @@ jobs:
           (cd linux && sha256sum *) >> checksums.sha256
           sha256sum owncord-src-*.tar.gz >> checksums.sha256
 
+      # The legacy top-level asset/sha256 pair stays bound to the Windows
+      # binary so already-deployed servers (which only understand the
+      # single-asset schema) can still verify and update; the assets list
+      # binds every OS. Server-side schema: updater.releaseManifest.
       - name: Generate server update manifest
         shell: bash
         run: |
-          SERVER_HASH=$(sha256sum windows/chatserver.exe | awk '{print $1}')
-          printf '{"version":"v%s","asset":"chatserver.exe","sha256":"%s"}' "$VERSION" "$SERVER_HASH" > windows/server-update-manifest.json
+          WIN_HASH=$(sha256sum windows/chatserver.exe | awk '{print $1}')
+          LINUX_HASH=$(sha256sum linux/chatserver-linux-amd64.tar.gz | awk '{print $1}')
+          printf '{"version":"v%s","asset":"chatserver.exe","sha256":"%s","assets":[{"asset":"chatserver.exe","sha256":"%s"},{"asset":"chatserver-linux-amd64.tar.gz","sha256":"%s"}]}' \
+            "$VERSION" "$WIN_HASH" "$WIN_HASH" "$LINUX_HASH" > windows/server-update-manifest.json
 
       - name: Sign server update assets
         working-directory: Client/tauri-client