fix(ci): publish signed Linux deb and rpm updater artifacts

[Soulter]

Summary / 改动概述

Linux .deb 客户端检查更新时会报 None of the fallback platforms ["linux-x86_64-deb", "linux-x86_64"] were found。当前发布流程虽然构建 .deb / .rpm，但只为 AppImage 生成 Linux 更新条目；R2 又只上传清单引用的更新包，因此缺少系统安装包的更新链路。

• 使用现有 Tauri 签名密钥签名 .deb / .rpm，校验产物数量和非空签名，并上传签名文件。
• 文件名规范化和清单生成支持这两种格式，分别生成 amd64 / arm64 对应的四个平台条目，保留 AppImage 支持。
• 发布时强制检查四个平台是否齐全。Stable 通过现有 R2 发布流程分发，nightly 保持 GitHub 下载地址。

合入后需重新运行发布流程，才会更新线上 R2 清单。本 PR 未修改线上对象。

Verification / 验证方式

• Python 3.12：python3.12 -m unittest discover -s scripts/ci -p 'test_*.py'，95 项通过。
• Node 测试（PATH 使用 Python 3.12）：node --test 'scripts/**/*.test.mjs'，192 项通过。
• 用临时测试密钥和项目固定的 Tauri CLI 2.10.0 执行实际工作流签名步骤，成功生成两种包的签名；未执行 Linux 安装升级测试。
• 新增回归覆盖 stable / nightly、两种架构、文件名规范化、R2 上传计划，以及缺包、重复包、缺签名、签名命令失败和缺平台时阻止发布。
• git diff --check 通过。
• 相关线上发布记录（修复前）：https://github.com/AstrBotDevs/AstrBot-desktop/actions/runs/34671391840

---

Checklist / 检查清单

• This change is not a breaking change. / 此改动不是破坏性变更。
• I have verified the change locally (and provided logs/screenshots above). / 我已在本地验证并在上方提供日志/截图。
• If workflows are changed, I attached at least one related Actions run link. / 如果修改了工作流，我已附上至少一个相关 Actions 运行链接。
• If dependencies are updated, lockfiles are updated accordingly (src-tauri/Cargo.lock, lockfiles under changed package dirs). / 未更改依赖。
• This PR does not include malicious code. / 此 PR 不包含恶意代码。

Summary by Sourcery

Publish signed Linux DEB and RPM updater artifacts and require complete platform coverage when generating release manifests.

New Features:

• Publish signed Linux DEB and RPM updater artifacts for amd64 and arm64 alongside existing AppImage updates.
• Generate updater manifest entries for Linux package formats with stable R2 and nightly GitHub distribution support.

Bug Fixes:

• Restore Linux package updater support so DEB and RPM clients can discover and download updates.

Enhancements:

• Normalize Linux package artifact names across supported formats and architectures.
• Require all four Linux package updater platforms before publishing a release.

Tests:

• Add regression coverage for Linux package signing, artifact normalization, manifest generation, R2 upload planning, and publication safeguards.

[sourcery-ai]

Sorry @Soulter, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 days and 3 hours by commenting @sourcery-ai review. Upgrade to get a review now.