setup: the installer is our own window — the alpha key is the gate, the release comes down with it and is verified before the silent install, and the in-app tour asks for the key too

.github/workflows/nightly.yml

@@ -108,3 +108,25 @@ jobs:
             console.log(JSON.stringify(m, null, 2));
           '
           gh release upload "$TAG" latest.json --repo "$TARGET" --clobber
+
+      # The file testers run: our own setup window (setup/). It carries no
+      # installer — it downloads the latest release with the tester's key and
+      # verifies the signature — so it is built the same for every release.
+      - name: Build SoulStream Setup
+        shell: bash
+        env:
+          VERSION: ${{ steps.stamp.outputs.version }}
+        run: |
+          npx vite build --config vite.setup.config.js
+          cargo build --release -p soulstream-setup
+          cp target/release/SoulStream-Setup.exe "SoulStream-Setup-$VERSION.exe"
+          ls -la "SoulStream-Setup-$VERSION.exe"
+
+      - name: Publish SoulStream Setup
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.RELEASES_TOKEN || secrets.GITHUB_TOKEN }}
+          TARGET: ${{ vars.RELEASES_OWNER || github.repository_owner }}/${{ vars.RELEASES_REPO || github.event.repository.name }}
+          TAG: nightly
+          VERSION: ${{ steps.stamp.outputs.version }}
+        run: gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber

.github/workflows/release.yml

@@ -91,3 +91,25 @@ jobs:
             console.log(JSON.stringify(m, null, 2));
           '
           gh release upload "$TAG" latest.json --repo "$TARGET" --clobber
+
+      # The file testers run: our own setup window (setup/). It carries no
+      # installer — it downloads the latest release with the tester's key and
+      # verifies the signature — so it is built the same for every release.
+      - name: Build SoulStream Setup
+        shell: bash
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          npx vite build --config vite.setup.config.js
+          cargo build --release -p soulstream-setup
+          cp target/release/SoulStream-Setup.exe "SoulStream-Setup-$VERSION.exe"
+          ls -la "SoulStream-Setup-$VERSION.exe"
+
+      - name: Publish SoulStream Setup
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.RELEASES_TOKEN || secrets.GITHUB_TOKEN }}
+          TARGET: ${{ vars.RELEASES_OWNER || github.repository_owner }}/${{ vars.RELEASES_REPO || github.event.repository.name }}
+          TAG: v${{ steps.version.outputs.version }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: gh release upload "$TAG" "SoulStream-Setup-$VERSION.exe" --repo "$TARGET" --clobber