fix: Windows desktop updater — sign setup.exe, preserve latest.json on deploy

Sign *-setup.exe for updater manifest, pick newest bundle per platform,
reconcile after git checkout, and stop overwriting latest.json with empty
placeholder. Bump desktop to 0.1.3.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/publish-desktop-update.sh

@@ -48,7 +48,7 @@ fi
 # updater 번들 서명
 if [[ -f "$KEY_PATH" ]]; then
   shopt -s nullglob
-  for bundle in "$PUBLISH_UPDATES"/*.tar.gz "$PUBLISH_UPDATES"/*.nsis.zip "$PUBLISH_UPDATES"/*.zip; do
+  for bundle in "$PUBLISH_UPDATES"/*.tar.gz "$PUBLISH_UPDATES"/*-setup.exe "$PUBLISH_UPDATES"/*.nsis.zip "$PUBLISH_UPDATES"/*.zip; do
     [[ -f "$bundle" ]] || continue
     [[ "$bundle" == *.sig ]] && continue
     log "Signing $(basename "$bundle")"
@@ -77,15 +77,7 @@ GEN_RC=$?
 set -e
 
 if [[ "$GEN_RC" -eq 2 ]]; then
-  log "[WARN] signed updater bundle 없음 — placeholder latest.json 작성"
-  cat > "$PUBLISH_UPDATES/latest.json" <<EOF
-{
-  "version": "$VERSION",
-  "notes": "$NOTES",
-  "pub_date": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "platforms": {}
-}
-EOF
+  log "[WARN] signed updater bundle 없음 — latest.json 유지 (placeholder 덮어쓰기 안 함)"
 elif [[ "$GEN_RC" -ne 0 ]]; then
   exit "$GEN_RC"
 fi