[appflowy]

The 0.14.7 → 0.14.11 macOS update is rejected because the released 0.14.11 app omits SUPublicEDKey. Its DMG signature, Apple code signature and notarization all pass, but Sparkle explicitly rejects removal of the key. Desktop #1481 removed it; Desktop #1533 has already restored it on main. Corrected macOS installers still need to be built and published.

This change validates the actual macOS bundle and compiled Windows public-key resource before packaging, then checks final installer signatures against the public keys verified in the released 0.14.7 clients. It verifies release asset hashes, Windows Authenticode and installer versions, and macOS code signing/notarization before producing update feeds. Both legacy and native feed filenames remain supported. Windows retains DSA/SHA1 compatibility with deployed WinSparkle clients. The Windows build also moves its two obsolete setup actions to supported equivalents, preserving Rust 1.92.0.

Validation:

• Reproduced the old generator accepting an invalid, well-formed signature; the regression now passes.
• 14 local tests passed; the Windows CI job passed all 15 applicable tests, including both Windows resource-loader tests (skipped locally on macOS). The suite uses real Ed25519/DSA signatures and compiles native Windows resource fixtures.
• Real Mach-O packaging/architecture/symlink tests passed; all four desktop-update manifest workflow checks passed; actionlint and diff checks passed.
• Published 0.14.11 macOS universal and Windows installers match GitHub SHA256 digests and valid update signatures. Both published macOS bundle variants correctly fail the new missing-key guard. The Windows signature verifies with the key extracted from the actual 0.14.7 executable.
• Existing macOS native updater consent tests: 5 passed. Flutter update-service tests could not compile against the caller checkout's stale generated protobufs (SearchEvidencePB, SearchEvidenceKindPB, ExportWorkspaceRequestPB.localImageDirectory). No app settings were changed.

This PR does not replace installers, upload feeds, or publish a release. The live release also lacks an Intel macOS appcast and all native-generation feeds. Publish the selected feed artifacts only after corrected installers are available and validated. Full application upgrade/install smoke tests remain a release validation step.