setup, updater: the installer window was a dev build with nothing inside it, and latest never matched a prerelease

Tauri decides dev-vs-production from the `custom-protocol` feature, not from
--release, and both workflows build the setup exe with a plain `cargo build`.
So cfg(dev) stayed on, the frontend was never embedded, and the window a
tester opened loaded devUrl: "localhost refused to connect" on a blank
800x580. The feature is a default of the crate now, with a build.rs guard
that fails a release build without it, and build.rs tracks setup/dist so a
changed window cannot be left out of the binary it is supposed to be in.

Behind that, the next wall: /releases/latest answers only with full
releases, and every release here is an alpha, so it 404s. The setup app read
that as a refused key and the app's Stable channel read it as a token that
cannot see the repository — both have been broken since the first alpha.
Each now lists /releases and takes the newest that is neither a draft nor
the rolling nightly, which the list really does put first.

And check_saved_key threw the saved key away on any failure at all, a
dropped connection included. The entry it deletes is the app's own updater
token, so only a refusal clears it now.

The release notes name the file to hand a tester: six assets on the page and
nothing saying which, while the bare NSIS installer is the biggest of them
and installs with no key gate and no signature check.

.github/workflows/nightly.yml

@@ -122,6 +122,9 @@ jobs:
           cp target/release/SoulStream-Setup.exe "SoulStream-Setup-$VERSION.exe"
           ls -la "SoulStream-Setup-$VERSION.exe"
 
+      # Which of the files on the page a tester runs, said on the page: the
+      # bare NSIS installer reads like the download and installs with no key
+      # gate and no signature check.
       - name: Publish SoulStream Setup
         shell: bash
         env:
@@ -129,4 +132,20 @@ jobs:
           TARGET: ${{ vars.RELEASES_OWNER || github.repository_owner }}/${{ vars.RELEASES_REPO || github.event.repository.name }}
           TAG: nightly
           VERSION: ${{ steps.stamp.outputs.version }}
-        run: gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber
+          SHA: ${{ github.sha }}
+        run: |
+          gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber
+          {
+            echo "### Download \`SoulStream-Setup-$VERSION.exe\`"
+            echo
+            echo "It asks for your alpha key, fetches this build with it, checks the signature and installs — no admin prompt."
+            echo
+            echo "The other files are the ones Setup uses:"
+            echo
+            echo "- \`SoulStream_${VERSION}_x64-setup.exe\` — the bare installer Setup downloads. Running it yourself skips the key and the signature check."
+            echo "- \`SoulStream_${VERSION}_x64-setup.exe.sig\` — its signature."
+            echo "- \`latest.json\` — the manifest the app's Nightly channel reads."
+            echo
+            echo "Built from main at $SHA. Nightlies can break."
+          } > notes.md
+          gh release edit "$TAG" --repo "$TARGET" --notes-file notes.md

.github/workflows/release.yml

@@ -105,6 +105,10 @@ jobs:
           cp target/release/SoulStream-Setup.exe "SoulStream-Setup-$VERSION.exe"
           ls -la "SoulStream-Setup-$VERSION.exe"
 
+      # Six files on the page and nothing saying which one a tester runs: the
+      # NSIS installer is the biggest and reads like the download, and running
+      # it puts the app on with no key gate and no signature check. The notes
+      # go on last, once the file they point at is actually up.
       - name: Publish SoulStream Setup
         shell: bash
         env:
@@ -112,4 +116,19 @@ jobs:
           TARGET: ${{ vars.RELEASES_OWNER || github.repository_owner }}/${{ vars.RELEASES_REPO || github.event.repository.name }}
           TAG: v${{ steps.version.outputs.version }}
           VERSION: ${{ steps.version.outputs.version }}
-        run: gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber
+        run: |
+          gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber
+          {
+            echo "### Download \`SoulStream-Setup-$VERSION.exe\`"
+            echo
+            echo "It asks for your alpha key, fetches this release with it, checks the signature and installs — no admin prompt."
+            echo
+            echo "The other files are the ones Setup uses:"
+            echo
+            echo "- \`SoulStream_${VERSION}_x64-setup.exe\` — the bare installer Setup downloads. Running it yourself skips the key and the signature check."
+            echo "- \`SoulStream_${VERSION}_x64-setup.exe.sig\` — its signature."
+            echo "- \`latest.json\` — the manifest the in-app updater reads."
+            echo
+            echo "See the commits since the last release."
+          } > notes.md
+          gh release edit "$TAG" --repo "$TARGET" --notes-file notes.md