fix(appimage): publish verified native updates in v1.9.1

[Jacobinwwey]

Summary

The AppImage catalog retest in AppImage/appimage.github.io#8838 passed v1.9.0 but reported missing update information. Linux builds now embed a native gh-releases-zsync target for the product Latest release and publish the official companion .zsync with the final AppImage.

The bundled zsyncmake writes into Tauri’s src-tauri working directory even when the AppImage output is absolute. The existing release artifact loop now collects that exact file and fails if it is missing. The artifact verifier checks the embedded owner/repository/channel/architecture, adjacent filename and relative URL, final file length/SHA-1 and checksum-table structure, alongside all existing portability and original-server integrity checks. This keeps existing Tauri argument forwarding intact and adds no updater UI or duplicate delta algorithm.

v1.9.1 aligns npm/Tauri product versions and documents local verification. Public v1.9.0 remains unchanged; because it lacks metadata, users must obtain this first update-capable release manually. An explicit control URL can still reuse v1.9.0 bytes during a delta update.

Test plan

• Final unfiltered Jest: 177 suites / 1,830 tests, no failures/skips/todos, natural exit 0.
• AppImage behavior tests: 3 suites / 71 tests, including 33 update cases using an official zsyncmake fixture and malformed/missing/stale controls.
• Strict Rust --locked: 34 passed, one pre-existing mobile probe ignored.
• build:mini/TypeScript, 40 frontend runtime assets, actionlint, actual workflow shell success/failure cases, version/lock consistency, Diataxis and documentation site.
• Official plugin and updater preflight: real Range/206 reconstruction and seed preservation on failed download. This uses synthetic fixtures, not release acceptance.
• Release CI 37266034722: Windows/macOS/Linux all passed. Four artifact ZIP digests, six release assets and same-build original server match.
• Real v1.9.0 → v1.9.1 reconstruction using official AppImageUpdate and zsync2: complete output SHA-256 equals 4f843ceffdf3c7c0596d901dd91604d0fa70a755ff9bea2ccd44e3eb76c0977b; real Range/206, 404 seed protection and ordinary-user host FUSE startup/normal exit passed.
• Complete Ubuntu 22.04.5 local KVM acceptance of the final artifact: unchanged catalog worker exit 0 with correct update metadata and no emitted missing-update-information warning; both native FUSE and extract-and-run passed offline APIs/pulldown, About 1.9.1, Force/DAG arrows, Markdown/Mermaid and Godot entry/return. Both normal closes exited 0; 26 observed application-related processes, five support processes and mounts were gone, followed by normal VM shutdown and host-state preservation. Summary and 12 screenshots. Extraction cache cleanup was manual after no-open-file checks; runtime manifests remain private evidence.
• Published assets re-downloaded anonymously and matched; native Latest discovery without override passed; official-client production CDN delta reconstructed the exact target over a direct connection. Update evidence and proxy-attempt limitations. npm 1.9.1/latest/gitHead/tarball integrity passed, as did all six post-merge main workflows.
• Upstream catalog retest 37281104290 passed the published v1.9.1 AppImage; bot result has no missing-update-information warning.

中文

本次补齐 #8838 剩余的 AppImage 原生更新信息警告：内嵌更新目标、收拢官方生成的 .zsync、对最终文件与控制文件进行成对校验并共同发布。保留所有已有可移植性与 server payload 门禁，避免硬编码输出目录影响既有构建参数。版本为 1.9.1，已公开的 1.9.0 不覆盖。

本地完整源码门禁、三平台 CI、精确制品散列、两个官方客户端真实差分重建和本机 Ubuntu 22.04 KVM 双模式验收已通过。目录检查未再发出更新信息警告；两模式 API、About 1.9.1、Force/DAG、Markdown/Mermaid、Godot 往返及正常退出均已实测，虚拟机正常关机，宿主状态保持不变。发布说明如实记录缓存人工清理和既有视觉限制。

已合并到 main（a233298ca9e574cc494f44c84d3a19fc101c9c53），v1.9.1 正式发布。公开下载、原生更新发现、直连生产 CDN 差分、npm 和合并后 main CI 均通过；#8838 实际重测 1.9.1 已通过且更新信息警告消失。