fix: Windows desktop updater — sign setup.exe, preserve latest.json on deploy

Sign *-setup.exe for updater manifest, pick newest bundle per platform,
reconcile after git checkout, and stop overwriting latest.json with empty
placeholder. Bump desktop to 0.1.3.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/generate-desktop-latest-json.mjs

@@ -29,7 +29,22 @@ if (!fs.existsSync(dir)) {
 
 const files = fs.readdirSync(dir);
 
-/** @type {Record<string, { url: string; signature: string }>} */
+function versionFromName(name) {
+  const m = name.match(/(\d+\.\d+\.\d+)/);
+  return m ? m[1] : '0.0.0';
+}
+
+function cmpSemver(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+/** @type {Record<string, { url: string; signature: string; bundleVersion: string }>} */
 const platforms = {};
 
 function addPlatform(platformKey, bundleName) {
@@ -43,9 +58,13 @@ function addPlatform(platformKey, bundleName) {
     console.warn(`[warn] missing signature: ${sigPath}`);
     return;
   }
+  const bundleVersion = versionFromName(bundleName);
+  const existing = platforms[platformKey];
+  if (existing && cmpSemver(bundleVersion, existing.bundleVersion) <= 0) return;
   platforms[platformKey] = {
     url: `${baseUrl}/${encodeURIComponent(bundleName)}`,
     signature,
+    bundleVersion,
   };
 }
 
@@ -72,7 +91,9 @@ const manifest = {
   version,
   notes,
   pub_date: new Date().toISOString(),
-  platforms,
+  platforms: Object.fromEntries(
+    Object.entries(platforms).map(([k, v]) => [k, { url: v.url, signature: v.signature }]),
+  ),
 };
 
 const outPath = path.join(dir, 'latest.json');