fix: desktop updater signing in non-interactive CI

Use --ci for key generation and pass empty password to tauri signer sign
so Jenkins/SSH builds can sign updater bundles without a TTY.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/prepare-tauri-build.sh

@@ -38,6 +38,7 @@ console.log('[prepare-tauri-build] createUpdaterArtifacts=' + enable);
 
 if [[ "$enable" == "true" ]]; then
   export TAURI_SIGNING_PRIVATE_KEY="$(tr -d '\n\r' < "$KEY_PATH")"
+  export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="${TAURI_SIGNING_PRIVATE_KEY_PASSWORD-}"
   echo "[prepare-tauri-build] updater signing enabled"
 else
   unset TAURI_SIGNING_PRIVATE_KEY 2>/dev/null || true