packaging: the installer learns the same two channels the app updates on

install.sh asked /releases/latest and installed whatever came back. That is
v0.1.0 today, which predates the updater, and it was about to get worse: the
`stable` pointer release write-manifest.sh creates is non-prerelease and holds
only latest.json, so from the next v* tag onward it would have WON
/releases/latest and the installer would have found nothing to install.

So resolve a channel instead of a "latest". `--channel stable|dev` (or
TS_CHANNEL), default stable, named to match update.rs's Channel exactly. dev
reads /releases/tags/dev. stable reads the pointer's own latest.json, takes its
version, and installs that v* release — the same file the app reads, so the
installer and the updater cannot disagree about what stable means.

Two things found on the way. The dev release's description still told people to
run the stable command, and always would have: publish-release.sh writes a body
only when it CREATES a release, and a fixed-tag release is only created once, so
the text froze at the first build. The 409 path now PATCHes it. And the asset
greps were unanchored, so a .AppImage.sig URL could match as the bundle URL —
harmless by coincidence, not by construction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKsUY9Z45KQd34V956hZ9Q

desktop/packaging/publish-release.sh

@@ -94,10 +94,22 @@ api() {
 first_id() { grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE '[0-9]+'; }
 
 # --- create (or reuse) the release for the tag ------------------------------
+# The install command printed on a release has to install THAT release's channel.
+# install.sh defaults to stable, so the rolling dev release must opt in explicitly
+# — otherwise someone following the instructions here lands on a tagged build and
+# wonders why the version they were sent isn't what they got.
+if [ "$TAG" = "dev" ]; then
+  INSTALL_TAIL='sh -s -- --channel dev'
+  CHANNEL_NOTE='\n\nThis is the rolling **dev** channel: republished on every green push to \`dev\`, and pruned to the current build.'
+else
+  INSTALL_TAIL='sh'
+  CHANNEL_NOTE=''
+fi
+
 echo "==> Creating release for $TAG"
 BODY=$(cat <<JSON
 {"tag_name":"$TAG","name":"ThoughtSync $TAG","draft":false,"prerelease":$RELEASE_PRERELEASE,
- "body":"ThoughtSync desktop $TAG.\n\n- **Debian / Ubuntu** — native \`.deb\`\n- **Arch / CachyOS** — native \`.pkg.tar.*\`\n- **everything else** — \`.AppImage\` (de-bundled graphics: renders on any GPU/Wayland setup)\n\nInstall / update — picks the right one for your system:\n\`\`\`\ncurl -fsSL $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/branch/dev/desktop/packaging/install.sh | sh\n\`\`\`"}
+ "body":"ThoughtSync desktop $TAG.\n\n- **Debian / Ubuntu** — native \`.deb\`\n- **Arch / CachyOS** — native \`.pkg.tar.*\`\n- **everything else** — \`.AppImage\` (de-bundled graphics: renders on any GPU/Wayland setup)\n\nInstall / update — picks the right one for your system:\n\`\`\`\ncurl -fsSL $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/branch/dev/desktop/packaging/install.sh | $INSTALL_TAIL\n\`\`\`$CHANNEL_NOTE"}
 JSON
 )
 # 409 = a release for this tag already exists (re-run) — fall through to lookup.
@@ -108,6 +120,11 @@ if [ -z "${RELEASE_ID:-}" ]; then
   echo "    release exists; fetching it by tag"
   release="$(api GET "$API/releases/tags/$TAG")"
   RELEASE_ID="$(printf '%s' "$release" | first_id)"
+  # And refresh its description. A fixed-tag release (dev, and any re-run) keeps
+  # whatever text the FIRST build wrote — including the install command. A stale
+  # one sends people to the wrong channel, silently.
+  echo "    refreshing its description"
+  api PATCH "$API/releases/$RELEASE_ID" -H "Content-Type: application/json" -d "$BODY" >/dev/null
 fi
 [ -n "${RELEASE_ID:-}" ] || { echo "ERROR: could not resolve release id" >&2; exit 1; }
 echo "    release id = $RELEASE_ID"