[feature] panel self-update via tauri-plugin-updater; pb check-updates reports patchbay itself

[YJack0000]

What

• The panel prompts to update itself. On launch it checks the release feed (latest.json on the latest GitHub release, minisign-verified); when a newer signed build exists a slim banner offers update and relaunch / not now. Download shows progress, install lands in place, relaunch is one click. Dev builds never check; an offline machine sees nothing (a failed check is silent).
• pb check-updates now reports patchbay itself — same 24 h cache, same GitHub lookup path and rate-limit stop as every other row; the update hint points at the release page rather than inventing a package manager.
• Release pipeline builds the updater artifact (.app.tar.gz + .sig, signed with the new TAURI_SIGNING_PRIVATE_KEY repo secret) and publishes latest.json alongside the DMG and CLI tarballs.

Notes for review

• The updater pubkey is committed in tauri.conf.json; the private key lives in the repo secrets and in the owner's own patchbay key vault (pb key list → patchbay-updater-signing-key).
• Known tradeoff (commented in the workflow): with createUpdaterArtifacts on, tauri build requires the signing key — a fork can still run CI (the panel job only typechecks/builds the front end) but cannot produce release bundles unsigned.

Verification

cargo test --workspace 601 passing (+3), clippy -D warnings clean, bun run build green, cargo check in src-tauri green. Local smoke: the self row renders patchbay 0.2.0 → latest from the cache path.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud