fix(release): tauri v2 ships .exe + .exe.sig, not .nsis.zip

v1 used to wrap the installer in a .nsis.zip and sign that wrapper.
v2 signs the .exe directly, so the updater url points at the .exe and
the .sig file sits next to it. Script was still looking for the
legacy .nsis.zip path and aborting after a successful build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/release.mjs

@@ -98,14 +98,15 @@ execSync('pnpm --filter @chat-app/desktop exec tauri build --bundles nsis', {
   stdio: 'inherit',
 });
 
+// Tauri v2 ships a single .exe + .exe.sig for NSIS updates — no .nsis.zip
+// wrapper like v1. The updater downloads the .exe directly, verifies the
+// minisign signature, then launches it in passive mode.
 const bundleDir = join(ROOT, 'apps/desktop/src-tauri/target/release/bundle/nsis');
-const zipName = `ChatApp_${versionArg}_x64-setup.nsis.zip`;
 const exeName = `ChatApp_${versionArg}_x64-setup.exe`;
-const sigName = `${zipName}.sig`;
-const zipPath = join(bundleDir, zipName);
+const sigName = `${exeName}.sig`;
 const exePath = join(bundleDir, exeName);
 const sigPath = join(bundleDir, sigName);
-for (const p of [zipPath, sigPath]) {
+for (const p of [exePath, sigPath]) {
   if (!existsSync(p)) {
     console.error(`Missing build artifact: ${p}`);
     process.exit(1);
@@ -120,7 +121,7 @@ const latest = {
   platforms: {
     'windows-x86_64': {
       signature,
-      url: `https://${env.UPDATE_HOST}/windows/${zipName}`,
+      url: `https://${env.UPDATE_HOST}/windows/${exeName}`,
     },
   },
 };
@@ -137,11 +138,8 @@ function scp(localPath) {
 }
 
 console.log('Uploading artifacts (JSON last so clients never see a stale ref)…');
-scp(zipPath);
+scp(exePath);
 scp(sigPath);
-// Also ship the bare installer so friends can download it directly via browser
-// without going through the updater — useful for the very first install.
-if (existsSync(exePath)) scp(exePath);
 scp(latestJsonPath);
 
 execSync(