Use --ci for key generation and pass empty password to tauri signer sign so Jenkins/SSH builds can sign updater bundles without a TTY. Co-authored-by: Cursor <cursoragent@cursor.com>