fix: desktop updater signing in non-interactive CI

Use --ci for key generation and pass empty password to tauri signer sign
so Jenkins/SSH builds can sign updater bundles without a TTY.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/publish-desktop-update.sh

@@ -52,7 +52,7 @@ if [[ -f "$KEY_PATH" ]]; then
     [[ -f "$bundle" ]] || continue
     [[ "$bundle" == *.sig ]] && continue
     log "Signing $(basename "$bundle")"
-    (cd "$DESKTOP_DIR" && npx tauri signer sign -f "$KEY_PATH" "$bundle")
+    (cd "$DESKTOP_DIR" && npx tauri signer sign -f "$KEY_PATH" -p "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD-}" "$bundle")
   done
   shopt -u nullglob
 else