setup, updater: the installer window was a dev build with nothing inside it, and latest never matched a prerelease

Tauri decides dev-vs-production from the `custom-protocol` feature, not from
--release, and both workflows build the setup exe with a plain `cargo build`.
So cfg(dev) stayed on, the frontend was never embedded, and the window a
tester opened loaded devUrl: "localhost refused to connect" on a blank
800x580. The feature is a default of the crate now, with a build.rs guard
that fails a release build without it, and build.rs tracks setup/dist so a
changed window cannot be left out of the binary it is supposed to be in.

Behind that, the next wall: /releases/latest answers only with full
releases, and every release here is an alpha, so it 404s. The setup app read
that as a refused key and the app's Stable channel read it as a token that
cannot see the repository — both have been broken since the first alpha.
Each now lists /releases and takes the newest that is neither a draft nor
the rolling nightly, which the list really does put first.

And check_saved_key threw the saved key away on any failure at all, a
dropped connection included. The entry it deletes is the app's own updater
token, so only a refusal clears it now.

The release notes name the file to hand a tester: six assets on the page and
nothing saying which, while the bare NSIS installer is the biggest of them
and installs with no key gate and no signature check.

setup/src-tauri/build.rs

@@ -4,9 +4,21 @@
 use std::path::{Path, PathBuf};
 
 fn main() {
+    // The frontend is embedded only when tauri's `custom-protocol` feature is
+    // on; without it the window points at devUrl and the exe we hand a tester
+    // shows "localhost refused to connect". It is a default feature, so this
+    // only fires when something turned the defaults off — and it fires at
+    // build time rather than on the tester's machine.
+    if tauri_build::is_dev() && std::env::var("PROFILE").as_deref() == Ok("release") {
+        panic!("SoulStream Setup: a release build needs the `custom-protocol` feature (on by default); without it the window loads devUrl and is blank");
+    }
     let manifest = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
     let conf = manifest.join("../../src-tauri/tauri.conf.json");
     println!("cargo:rerun-if-changed={}", conf.display());
+    // tauri-build tracks the config, not the frontend the exe embeds: without
+    // this, a changed Setup.svelte rebuilds `setup/dist` and cargo hands back
+    // yesterday's binary, still carrying yesterday's window.
+    println!("cargo:rerun-if-changed={}", manifest.join("../dist").display());
     let text = std::fs::read_to_string(&conf).expect("read src-tauri/tauri.conf.json");
     let json: serde_json::Value = serde_json::from_str(&text).expect("parse tauri.conf.json");
     let pubkey = json["plugins"]["updater"]["pubkey"]