fix(ci): download draft release signatures via API

[LRainner]

Summary

• download updater signature files through the authenticated GitHub Release Asset API while a release is still a draft
• keep public browser_download_url values in latest.json for updater clients
• keep the fix scoped to the updater manifest generator

Root cause

The atomic release workflow generates latest.json before publishing the GitHub Release. Draft assets use untagged-* browser download URLs, which return 404 until publication. This caused the v1.2.2 workflow to fail while reading the Windows signature after both platform bundles had uploaded successfully.

The manifest generator now downloads each .sig file from its authenticated asset API URL with Accept: application/octet-stream. Installer URLs written into the manifest remain unchanged.

Verification

• node --check scripts/generate-updater-manifest.mjs
• git diff --check
• generated a manifest against draft Release ID 360055621 (v1.2.2)
• verified non-empty release notes and both macOS and Windows signatures

Release handling

v1.2.2 remains an unpublished draft and is intentionally not recovered or published by this PR. The fix applies to subsequent releases.

Summary by CodeRabbit

• Bug Fixes
  • Improved update verification by ensuring release signature files are retrieved consistently.
  • Helps prevent issues when validating downloaded updates and improves the reliability of the update process.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c49e49d0-eb7a-4fd0-94f1-bde1f487034c

📥 Commits

Reviewing files that changed from the base of the PR and between 4592203 and 577c9b3.

📒 Files selected for processing (1)

• scripts/generate-updater-manifest.mjs

---

📝 Walkthrough

Walkthrough

The updater manifest generator now fetches signature files through the asset API URL with an explicit application/octet-stream Accept header. Response handling and signature parsing remain unchanged.

Changes

Signature download handling

Layer / File(s)	Summary
Fetch signature assets scripts/generate-updater-manifest.mjs	signatureFor uses signatureAsset.url and an explicit Accept: "application/octet-stream" header when downloading signatures.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fetching draft release signatures through the GitHub API.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}