fix(ci): avoid secrets in step conditions

[TimeToBuildBob]

Summary

• move the signing-key presence check to job-level env, where the secrets context is valid
• gate updater artifact configuration through that derived environment value
• pass the same derived value to includeUpdaterJson in the release workflow

Root cause

#235 introduced secrets.TAURI_SIGNING_PRIVATE_KEY directly in step-level if: expressions. GitHub rejects that context while parsing a workflow, so both Build and Release failed immediately with zero jobs and no logs on master.

Verification

• actionlint -shellcheck='' .github/workflows/build.yml .github/workflows/release.yml
• git diff --check

[greptile-apps]

Greptile Summary

This PR restores workflow parsing by deriving signing-key availability at job scope.

• Adds a job-level HAS_TAURI_SIGNING_KEY environment value to Build and Release.
• Uses the derived value to gate updater artifact configuration.
• Passes the same value to the release action’s updater JSON setting.

Confidence Score: 5/5

The PR appears safe to merge, with no changed-code-triggered defects identified.

The derived environment value preserves the signing-key presence semantics while avoiding the invalid direct use of the secrets context in step conditions.

Important Files Changed

Filename	Overview
.github/workflows/build.yml	Moves the signing-key presence check into job-level environment context and correctly gates updater artifact configuration.
.github/workflows/release.yml	Reuses the job-level signing-key indicator for updater artifact configuration and release updater JSON behavior.

_{Reviews (1): Last reviewed commit: "fix(ci): avoid secrets in step condition..." | Re-trigger Greptile}

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.