Fix signed revision updates without duplicate release downloads

[CryptoKey98]

Manager releases currently expose duplicate packages to support both older updater filenames and signed revisions. Publish one package per platform, architecture and format under the legacy-compatible filename, and point signed metadata at that same package. Hotfixes replace only affected platform downloads; the checksum list retains all targets.

Debian revision updates explicitly reinstall the compatible package so its updated executable is installed even when the package version stays unchanged. Refresh cached release details when they disagree with signed metadata, and version GitHub download URLs by their published digest to avoid reusing stale redirects. Signature and checksum verification remain enforced.

The workflow also supports rebuilding a baseline as a draft without publishing it.

Validation:

• 16 actual update transactions passed: Windows x64 portable/MSI and Ubuntu, Fedora, Arch portable/native; each tested 0.8.2 directly to Rev. 2 and Rev. 1 to Rev. 2.
• All cases preserved settings and test data, restarted successfully and reported no repeat update.
• Actual Windows and Linux clients rejected tampered signed metadata before staging.
• Rust: 264 tests passed, 1 ignored. Windows and Linux Clippy passed; formatting and release workflow actionlint passed.
• All 10 publishing/validation Python tests passed on Ubuntu, including Debian package and isolated APT simulation tests.
• Native test installations were removed; Ubuntu's original 0.8.2 executable was restored byte-for-byte.

Linux tray and AppImage fixes are excluded and remain reserved for Rev. 2. Production 0.8.3 remains deleted; this PR does not republish it. macOS runtime upgrade testing and Windows x86 live upgrade transactions were not repeated.