feat: Desktop auto-updater + release SBOMs

- tauri-plugin-updater + process: pubkey embedded in tauri.conf.json,
  createUpdaterArtifacts, endpoint = GitHub latest.json manifest.
- Connect screen checks before auto-connect (bounded 5s) — a saved
  URL would otherwise navigate away before the check resolves.
  "Update & restart" downloads, verifies minisign, installs, relaunches.
- Release workflow signs updater artifacts with
  TAURI_SIGNING_PRIVATE_KEY secrets, ships the .sig files, and assembles
  latest.json from them. No key → no manifest → no update, never a
  silent unsigned install.
- anchore/sbom-action emits CycloneDX SBOMs per GHCR image plus the
  source tree, attached to every release.

Note: the signing keypair was generated locally
(~/.tauri/primora-updater.key); the private half must be added to repo
secrets before the next release for updates to activate.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/desktop/README.md

@@ -44,3 +44,21 @@ file, one crypto implementation — terminal and desktop always agree. Requires
 Injection and the credential broker stay CLI-only (`primora inject`,
 `primora agent`).
 - Deep links / push notifications: deliberately omitted — nothing needs them yet.
+
+## Auto-updates
+
+`tauri-plugin-updater` checks `releases/latest/download/latest.json` on the
+GitHub repo when the connect screen loads; if a newer signed release exists
+it offers "Update & restart" — download, minisign verification, install,
+relaunch. No update manifest or signature failure = silent no-op; unsigned
+artifacts can never install.
+
+Release side (already wired in `.github/workflows/release.yml`): the desktop
+job signs updater artifacts with `TAURI_SIGNING_PRIVATE_KEY` (+ optional
+`TAURI_SIGNING_PRIVATE_KEY_PASSWORD`) repo secrets, uploads the `.sig`
+files, and the release job assembles `latest.json` from them. Without the
+secret the build still succeeds but emits no signatures — and no manifest.
+
+The matching public key is embedded in `tauri.conf.json`. The private key
+lives only in repo secrets and on the maintainer's machine — regenerate with
+`npx tauri signer generate` and update both if it is ever lost.