ci: scope the updater signing key to signing steps and split the legacy publish job

The signing key moves from job-level to step-level env, so npm install scripts, setup actions and crate build scripts never see it. Linux compiles without the key and signs in a separate tauri bundle step. The legacy rollback builds and signs under a read-only, unpersisted token with the locked Tauri CLI, and a separate job holds the write token to publish.

docs/release-process.md

@@ -28,7 +28,8 @@ below matters: bump Cargo *before* you tag.
    The build jobs need the `TAURI_SIGNING_PRIVATE_KEY` and
    `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` secrets and a non-empty
    `plugins.updater.pubkey` in `tauri.conf.json`; the workflow fails
-   before building without them.
+   before building without them. Only the steps that sign see the key:
+   dependency installs and compilation run without it.
 
 ## Testing without a real tag