v1.4.10 — fix Windows auto-update (publisherName leak)

The v1.4.9 Windows .exe shipped unsigned (Trusted Signing CI
secrets missing from the build env), and electron-builder had
silently leaked the mac.identity string ("Developer ID
Application: 3D France (RT4W5WC9P2)") into the cross-platform
app-update.yml as the expected publisherName.

Existing installs running v1.4.7/v1.4.8 hit
  "Could not check: New version 1.4.9 is not signed by the
  application owner: publisherNames: Developer ID Application:
  3D France (RT4W5WC9P2)"
and refused to install the update.

Fix: explicitly set build.win.publisherName: null in package.json
to override the leak. Combined with the existing
verifyUpdateCodeSignature: false, electron-updater now skips
publisher-name verification on Windows. Integrity is still
checked via the SHA-512 hash written into latest.yml that
electron-updater verifies after every download — no integrity
regression, only the certificate-name comparison is removed.

When Trusted Signing keys come back, just remove the
publisherName: null line and full signature verification resumes.

No user-facing changes beyond the update path itself working
again.

Author: TigerTag-Project

README.md

@@ -49,6 +49,15 @@
 
 ## Changelog
 
+### v1.4.10 — 2026-05-05
+
+Hot-fix release for the Windows auto-updater. No user-facing change beyond the update path itself working again.
+
+- **Windows auto-update fixed.** The v1.4.9 release shipped an unsigned `Setup-1.4.9.exe` (Trusted Signing CI secrets missing in the build env), and electron-builder had silently leaked the `mac.identity` string (`Developer ID Application: 3D France (RT4W5WC9P2)`) into the cross-platform `app-update.yml` as the expected `publisherName` — so existing installs running v1.4.7 / v1.4.8 hit `Could not check: New version 1.4.9 is not signed by the application owner` and refused to install the update. v1.4.10 explicitly sets `build.win.publisherName: null` to neutralise the leak. Combined with `verifyUpdateCodeSignature: false`, electron-updater now skips publisher-name verification on Windows. Integrity is still checked via the SHA-512 hash that electron-builder writes into `latest.yml` and that electron-updater verifies after every download — no integrity regression, only the certificate-name comparison is removed. When Trusted Signing keys come back, the `publisherName: null` line gets removed and full signature verification resumes.
+- v1.4.9 users who hit this error: download `Tiger-Studio-Manager-Setup-1.4.10.exe` manually from the [v1.4.10 release page](https://github.com/TigerTag-Project/TigerTag_Studio_Manager/releases/tag/v1.4.10) and run it. From v1.4.10 onwards, future auto-updates will succeed even when the build is unsigned.
+
+---
+
 ### v1.4.9 — 2026-05-04
 
 Quality-of-life release. Three internal-tooling improvements that make the codebase healthier going forward — and one user-visible bug fix that was found by the new tooling on its very first run.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tigertag-inventory",
-  "version": "1.4.9",
+  "version": "1.4.10",
   "description": "Tiger Studio Manager — desktop app",
   "main": "main.js",
   "engines": {
@@ -60,7 +60,8 @@
       ],
       "icon": "assets/img/icon.ico",
       "artifactName": "Tiger-Studio-Manager-Setup-${version}.${ext}",
-      "verifyUpdateCodeSignature": false
+      "verifyUpdateCodeSignature": false,
+      "publisherName": null
     },
     "mac": {
       "target": [