ci: re-sign the AppImage after de-bundling, or Linux updates can never verify

The de-bundle step deletes the AppImage and repackages it without the host
graphics libraries — necessary, and it runs AFTER tauri signed the original.
So the .sig published on the release described a file that no longer existed,
and every Linux in-app update would have failed signature verification.

Worth naming the failure mode: the error would have said the signature didn't
match, which points at the key, the manifest, or the download — anywhere except
"a later build step rewrote the file after signing it". The Windows lane hid it
too, because nothing post-processes the NSIS installer, so the one platform
already verified working was the one platform that couldn't reveal the bug.

Signs the file that actually ships, and fails the build if no .sig comes out
rather than quietly publishing an unverifiable bundle.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

.forgejo/workflows/desktop.yml

@@ -108,6 +108,29 @@ jobs:
       - name: De-bundle AppImage graphics libraries
         run: bash desktop/packaging/appimage/debundle-graphics.sh
 
+      # MUST run after de-bundling, not before. The step above DELETES the AppImage
+      # and repackages it, so the signature tauri produced during the build now
+      # describes a file that no longer exists. Publishing that stale .sig would make
+      # every Linux update fail verification — and the error names a signature
+      # mismatch, which points nowhere near "a later build step rewrote the file".
+      # Windows needs no equivalent: nothing post-processes the NSIS installer.
+      - name: Re-sign the de-bundled AppImage
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
+            echo "No signing key — the build produced no signature to replace."
+            exit 0
+          fi
+          appimage="$(find target/release/bundle/appimage -name '*.AppImage' -type f | head -1)"
+          [ -n "$appimage" ] || { echo "ERROR: no AppImage found to re-sign" >&2; exit 1; }
+          rm -f "$appimage.sig"
+          cargo tauri signer sign "$appimage"
+          [ -s "$appimage.sig" ] || { echo "ERROR: re-signing produced no .sig" >&2; exit 1; }
+          echo "Re-signed $(basename "$appimage")"
+        working-directory: desktop/src-tauri
+
       # install.sh hands the .deb to every Debian/Ubuntu user, so the package's
       # Depends must be right BEFORE a release exists. Prints the generated
       # control file and cross-checks it against what the ELF actually needs