ci, install: update workflows, packaging scripts, and installer suite

Nightly/release workflows: matrix tweaks, artifact path fixes.
Package-macos: streamline dmg build, codesigning improvements.
Install scripts: rewrite install.sh and install-nightly.sh with
robust error handling, add uninstall.sh, overhaul update.sh.

.gitea/workflows/nightly.yml

@@ -52,7 +52,15 @@ jobs:
       - name: Deploy to builds.skaldagent.net
         run: |
           cd "${GITHUB_WORKSPACE:-.}"
-          mkdir -p /var/www/builds.skaldagent.net/nightly
-          cp dist/*.tar.gz /var/www/builds.skaldagent.net/nightly/
+          DEST=/var/www/builds.skaldagent.net/nightly
+          mkdir -p "$DEST"
+          # Nightly reuses a fixed filename, so publish atomically: copy to a
+          # temp name on the same filesystem, then rename over the target. A
+          # concurrent download never sees a half-written tarball.
+          for f in dist/*.tar.gz; do
+            name="$(basename "$f")"
+            cp "$f" "$DEST/.$name.tmp"
+            mv -f "$DEST/.$name.tmp" "$DEST/$name"
+          done
           echo "[nightly] Deployed:"
-          ls -lh /var/www/builds.skaldagent.net/nightly/
+          ls -lh "$DEST/"

.gitea/workflows/release.yml

@@ -85,11 +85,22 @@ jobs:
           VERSION="${{ steps.extract-version.outputs.version }}"
           TARGET="/var/www/builds.skaldagent.net/releases/${VERSION}"
           mkdir -p "$TARGET"
-          cp dist/*.tar.gz "$TARGET/"
+          # Publish each tarball atomically (temp name + rename) so a client can
+          # never fetch a half-written file.
+          for f in dist/*.tar.gz; do
+            name="$(basename "$f")"
+            cp "$f" "$TARGET/.$name.tmp"
+            mv -f "$TARGET/.$name.tmp" "$TARGET/$name"
+          done
           echo "[release] Deployed $VERSION:"
           ls -lh "$TARGET/"
 
       - name: Update latest version pointer
         run: |
-          echo "${{ steps.extract-version.outputs.version }}" > /var/www/builds.skaldagent.net/releases/LATEST
-          echo "[release] Updated releases/LATEST → ${{ steps.extract-version.outputs.version }}"
+          VERSION="${{ steps.extract-version.outputs.version }}"
+          DEST=/var/www/builds.skaldagent.net/releases
+          # Flip LATEST atomically — install.sh/update.sh read it to decide
+          # whether to upgrade, so it must never be observed empty or partial.
+          printf '%s\n' "$VERSION" > "$DEST/.LATEST.tmp"
+          mv -f "$DEST/.LATEST.tmp" "$DEST/LATEST"
+          echo "[release] Updated releases/LATEST → $VERSION"