fix(updater): recover from missing latest.json and harden CI pipeline

- Add createUpdaterArtifacts: true to both tauri.conf.json and tauri.conf.prod.json
- Add isManualUpdateMode to updater types, store, and API
- Implement GitHub API fallback when latest.json is missing (e.g., v0.3.3 without updater manifest)
- Open browser to release page in manual-update mode for download/install
- Show amber manual-update banner and 'Open Download Page' button in AppPreferences
- Harden release.yml: fail publish step if latest.json or .sig files are missing