Release Production fails on both macOS legs: upload-macos-artifacts.sh calls `cargo tauri`, which the workflow never installs

[M3gA-Mind]

Summary

Every Release Production run fails on both macOS legs at the last step of a ~50-minute job.
scripts/release/upload-macos-artifacts.sh:48 invokes cargo tauri signer sign, but the
release workflow never installs cargo-tauri. The build itself does not need it — build-desktop.yml
builds with pnpm tauri build (the npm @tauri-apps/cli) — so the CLI is present as an npm binary
and absent as a cargo subcommand. The script reaches for the form that does not exist.

Production releases are blocked until this is fixed.

Evidence

Run 32475039986, attempt 1,
release @ 2b220b826, v0.63.15. Both Desktop: aarch64-apple-darwin (49m50s) and
Desktop: x86_64-apple-darwin (44m22s) failed at step 28, Re-upload notarized macOS artifacts to release:

[upload] Deleting old DMG asset from release...
[upload] Uploading notarized DMG...
[upload] Signing updater tarball with Tauri signer...
error: no such command: `tauri`
help: find a package to install `tauri` with `cargo search cargo-tauri`
##[error]Process completed with exit code 101.

Everything before it passed: Sign and notarize macOS .app, Re-package DMG after notarization,
The staple and validate action worked!, [dmg] Verification successful: layout preserved.
This is not the Apple notary flake seen previously — notarization succeeded on both legs.

• Failing call site: scripts/release/upload-macos-artifacts.sh:48
• Introduced by 3131b3829 "feat(release): enhance macOS artifact upload and signing process" — the only commit that has ever touched that line
• The workflow installs no cargo-tauri: grep -E "cargo install|cargo-tauri|tauri-cli" .github/workflows/release-production.yml → no matches
• Present on main as well as release — same line, same text

Blast radius

1. The macOS DMG upload happens before the failing signer call, so a failed run still mutates
   the release: it deletes the previous DMG asset and uploads the new one, then dies. The
   .app.tar.gz and its .sig are never uploaded, and Publish updater manifest (latest.json),
   Publish draft release, Docker: tag :latest and Record Sentry deploy marker are all skipped.
   The v0.63.15 draft is left with a partial asset set.
2. The run cannot be re-run. The Remove release and tag if build failed cleanup job deletes the
   v0.63.15 tag after attempt 1. On attempt 2 both macOS jobs failed at Checkout build ref —
   git fetch ... +refs/heads/v0.63.15* found nothing (exit 1 after 3 tries) — and the cleanup job
   itself then failed at Delete remote tag because the tag was already gone. A fresh dispatch is
   required, not a re-run.

Fix direction

Use the CLI the workflow actually installs. Either invoke it through pnpm/npx (matching
pnpm tauri build in build-desktop.yml), or install cargo-tauri in the macOS job — but the
first is consistent with how the rest of the lane already works.

Worth noting for whoever picks this up: the Linux equivalent of this call, resign_artifact() in
scripts/release/strip-appimage-graphics-libs.sh:850-860, guards it —
command -v cargo-tauri || { warn; return; } — and so degrades instead of failing the job. The
macOS script has no such guard. Whichever way the invocation is fixed, the two call sites should
agree; and a guard that silently skips signing on a release lane is worth a second look on its own.

Acceptance criteria

• A Release Production run completes both macOS legs through artifact upload
• The published release carries .dmg, .app.tar.gz and .app.tar.gz.sig for both aarch64 and x86_64
• Publish updater manifest (latest.json) runs instead of being skipped
• The invocation cannot silently no-op — if the signer is unavailable the step fails loudly, rather than uploading an unsigned or unsignatured updater artifact
• Both cargo tauri signer sign call sites (macOS + Linux) use the same, available invocation

Follow-ups (not this issue, file separately if agreed)

• The failure-cleanup job deletes the tag even when release assets were already uploaded, making a re-run structurally impossible.
• upload-macos-artifacts.sh performs destructive work (delete + re-upload the DMG asset) before a step that can fail.