[appflowy]

Native update tests exposed a Windows signing defect: Builder signed the installer directly with DSA/SHA1, while both WinSparkle 0.8.1 and 0.9.4 verify DSA over SHA1(SHA1(installer)). The old Python validator repeated the same mistake. Fix both signing and validation to follow upstream's legacy protocol, with a native regression case rejecting the former single-hash signature.

The macOS regression test reproduces the 0.14.7 → 0.14.11 failure: a valid archive signature is rejected when the target bundle removes its Sparkle key. Packaging checks alone do not prove the updater can install and restart the app.

Add native Sparkle 2.8.1 / WinSparkle 0.8.1 and 0.9.4 lifecycle tests on macOS ARM64, macOS Intel and Windows x64. The 0.8.1 DLL exactly matches the one shipped in AppFlowy 0.14.7. An external controller serves signed fixture packages and observes installation, old-process exit, new-process launch and preserved test data. Negative cases cover the wrong signing key, Windows single-hash signatures, macOS key removal and skipping an update. PR tests use temporary keys and isolated storage, without release secrets.

Gate auto_update.yaml appcast artifacts on installing the final signed release installer through the native engine, verifying the installed version/key/updater library, and keeping the real AppFlowy process alive for 15 seconds. Both Windows engines run this gate. Add testOnly=true to rehearse against draft or published releases without the version-configuration commit. Capture native events, HTTP requests, installer hash and logs on failure. Also fix macOS Bash 3.2 feed generation when optional metadata is absent: the argument array must remain nonempty under set -u.

Scope: the release test uses an instrumented native source host with the deployed public key. It does not exercise Flutter/cloud discovery, consent UI, workspace migration, or candidate → N+1. Windows AppFlowy startup is explicitly controller-driven after Inno finishes, because the production installer has no relaunch entry. See scripts/update_e2e/README.md for commands and limits.

Validation:

• Final native CI: all 14 scenarios passed across macOS ARM64, macOS Intel, WinSparkle 0.8.1 and WinSparkle 0.9.4.
• Final validation CI: passed on Windows, macOS and Linux, including the Bash 3.2 regression test and Windows compiled-key checks.
• Windows release rehearsal: installed and started the real signed 0.14.7 package through both engines; the version-configuration job was skipped with testOnly=true.
• macOS Intel release rehearsal: native installation/startup passed. A later feed-generation step exposed the Bash 3.2 bug fixed here. The same rehearsal correctly blocked the 0.14.7 universal package because Gatekeeper reported it as unnotarized; the next release must pass that gate with its final package.
• Workflow lint passed with the existing disabled Linux step's constant-false warning excluded.