fix: Mac desktop updater — v0.1.2 with signed pubkey; clearer errors

Rebuild dmg with real updater.pub. Improve check failure messages and
fix publish signing when TAURI_SIGNING_PRIVATE_KEY is set.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/publish-desktop-update.sh

@@ -52,6 +52,7 @@ if [[ -f "$KEY_PATH" ]]; then
     [[ -f "$bundle" ]] || continue
     [[ "$bundle" == *.sig ]] && continue
     log "Signing $(basename "$bundle")"
+    unset TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD 2>/dev/null || true
     (cd "$DESKTOP_DIR" && npx tauri signer sign -f "$KEY_PATH" -p "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD-}" "$bundle")
   done
   shopt -u nullglob