ci(release): drop stray latest.json from release assets (#52)

## Summary

`tauri-apps/tauri-action` attaches a `latest.json` updater manifest to
the GitHub Release on publish even though the build job sets
`uploadUpdaterJson: false`. The app uses Cloudflare-hosted,
channel-in-path manifests (`updates/<channel>/<os>/<arch>/update.json`),
so the stray target-flat `latest.json` is harmless but is confusing
clutter on the Release assets (issue #29).

This adds an idempotent post-publish cleanup step that deletes any
`latest.json` asset from the just-created GitHub Release for the pushed
tag.

### What changed

- `.github/workflows/release.yml`: new step `Remove stray latest.json
from the release` in the `publish-updater-manifest` job.
- That job runs ONCE (`needs: build`), so it executes only after every
matrix build's `tauri-action` upload has completed. It already has the
tag (`RELEASE_TAG: ${{ github.ref_name }}`, job-level env - not
hardcoded) and `GITHUB_TOKEN`, so the cleanup runs exactly once after
all assets exist.
- Idempotent: it queries `gh release view "$RELEASE_TAG" --json assets`
for an asset named `latest.json` and only calls `gh release delete-asset
"$RELEASE_TAG" latest.json --yes` when one is present; otherwise it logs
and exits 0. The `gh release view ... --json assets --jq` / `gh release
delete-asset ... --yes` forms match the patterns already used in
`dev-channel.yml`.

### Why `uploadUpdaterJson: false` does not suppress it

`src-tauri/tauri.conf.json` sets `bundle.createUpdaterArtifacts: true`,
so the Tauri bundler emits updater artifacts and tauri-action generates
a `latest.json`. Per the tauri-action `action.yml` + docs (verified via
Context7), `uploadUpdaterJson` (default `true`) is the correct input and
the current `dev` branch gates the upload on it (`if
(shouldUploadUpdaterJson) { uploadVersionJSON(...) }`). However this
repo pins the floating `tauri-apps/tauri-action@v0` major tag, whose
resolved build does not match that current `dev`-branch logic, so the
generated `latest.json` is still attached despite the flag. The input
name itself is correct (a previous codex pass already confirmed
`includeUpdaterJson` does not exist), so renaming is not the fix - the
robust fix shipped here is the post-publish delete.

### Why dev-channel.yml is unchanged

`dev-channel.yml`'s `tauri-action` step has NO `tagName`, so it builds
only and creates/uploads no release (and thus no `latest.json`). The
rolling `dev` pre-release is assembled by `softprops/action-gh-release`
from `dev-artifacts/*`, which is populated by a `find` allow-list
(`.dmg`, `.app.tar.gz(.sig)`, `.msi(.sig)`, `-setup.exe(.sig)`,
`.AppImage(.sig)`, `.deb`) that excludes `latest.json`. And even if a
`latest.json` ever did land there, the existing `gc-stale-dev-assets`
job already deletes every asset not carrying the run's dev version. So
no cleanup is needed there.

## Testing

This is YAML/CI only - no app code changed, so the pnpm/cargo gates were
skipped per the task. Validation run:

- `actionlint .github/workflows/release.yml` - PASS
- `actionlint .github/workflows/dev-channel.yml` - PASS (unchanged,
sanity check)
- `python -c "import yaml;
yaml.safe_load(open('.github/workflows/release.yml'))"` - parses
- `python -c "import yaml;
yaml.safe_load(open('.github/workflows/dev-channel.yml'))"` - parses
- `git diff | grep -P '[^\x00-\x7F]'` - no non-ASCII introduced; file
remains LF ASCII text
- Step ordering verified: the cleanup lives in
`publish-updater-manifest` (`needs: build`), so it runs after all
`tauri-action` uploads; `RELEASE_TAG` resolves from job-level
`github.ref_name`.

This cannot be fully proven until the next real tagged release exercises
`release.yml` end to end (the cleanup only runs on a `v*` tag push). The
idempotent `delete-asset` + actionlint/YAML lint is the ceiling here;
the delete is a safe no-op if `latest.json` is ever absent.

Closes #29

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01MZQh3ZfwtZsM6c5qnTuWZP

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: pmaxhogan

.github/workflows/release.yml

@@ -173,6 +173,39 @@ jobs:
         with:
           node-version: 22
 
+      # Issue #29: drop the stray `latest.json` updater manifest tauri-action
+      # attaches to the GitHub Release. `uploadUpdaterJson: false` (set on the
+      # build job's tauri-action step, verified the correct input name) is SUPPOSED
+      # to suppress it, but it does not reliably do so on the floating
+      # `tauri-apps/tauri-action@v0` tag: tauri.conf.json sets
+      # `createUpdaterArtifacts: true`, so the bundler emits updater artifacts and
+      # the pinned `@v0` build still uploads a generated `latest.json` (a
+      # tauri-action version quirk - the current `dev` branch gates the upload on
+      # the flag, but the resolved `@v0` build's behavior differs). Driven serves
+      # its own channel-in-path manifests from Cloudflare Pages
+      # (updates/<channel>/<os>/<arch>/update.json), so a target-flat `latest.json`
+      # on the Release is just confusing clutter. Delete it post-publish. This job
+      # runs ONCE (needs: build) after every matrix build's tauri-action upload has
+      # completed and has the tag (RELEASE_TAG) + GITHUB_TOKEN, so the cleanup
+      # happens exactly once after all assets exist. Idempotent: a no-op (exit 0)
+      # when no `latest.json` asset is present.
+      - name: Remove stray latest.json from the release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          has_latest="$(gh release view "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --json assets \
+            --jq '[.assets[] | select(.name == "latest.json")] | length')"
+          if [ "${has_latest:-0}" -gt 0 ]; then
+            echo "deleting stray latest.json from release $RELEASE_TAG"
+            gh release delete-asset "$RELEASE_TAG" latest.json --yes \
+              --repo "$GITHUB_REPOSITORY"
+          else
+            echo "no latest.json asset on release $RELEASE_TAG (nothing to clean up)"
+          fi
+
       # R1-P1-2: the generator reads bundles + `.sig` from a local dir, but the
       # matrix build artifacts live as GitHub Release assets. Download the
       # just-published release's assets into a flat dir so the generator has real