fix(ci): release-owner — fetch TAURI_SIGNING_PRIVATE_KEY from Infisical

owner-v0.10.0 build failed: tauri.conf.json now has plugins.updater.pubkey
(real auto-update), so tauri-action refuses to bundle without the matching
private key. release-owner.yml never fetched it — only release.yml (app) did.
Mirrors the /updater Infisical step + env var already used there.

Author: vitaliytv

.github/workflows/release-owner.yml

@@ -1,8 +1,8 @@
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 #
 # Реліз owner-застосунку (воркспейс owner/) — аналог release.yml для app.
-# Тег owner-vX.Y.Z → GitHub-реліз "owner owner-vX.Y.Z" + підписаний DMG.
-# Без updater-артефактів: owner не має tauri-plugin-updater (MVP M0).
+# Тег owner-vX.Y.Z → GitHub-реліз "owner owner-vX.Y.Z" + підписаний DMG +
+# updater-артефакти (owner має tauri-plugin-updater, useUpdater()).
 
 name: Release Owner
 
@@ -73,6 +73,16 @@ jobs:
           env-slug: 'main'
           secret-path: '/apple'
 
+      - name: Fetch updater signing key from Infisical
+        uses: Infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16
+        with:
+          method: 'oidc'
+          domain: 'https://secret.7n.ai'
+          project-slug: 'vitaliytv-kfse'
+          identity-id: '53691c96-17d9-4389-b078-0f77073809ab'
+          env-slug: 'main'
+          secret-path: '/updater'
+
       - uses: ./.github/actions/setup-bun-deps
 
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
@@ -99,6 +109,7 @@ jobs:
           APPLE_ID: ${{ env.APPLE_ID }}
           APPLE_PASSWORD: ${{ env.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ env.TAURI_SIGNING_PRIVATE_KEY }}
         with:
           projectPath: owner
           releaseId: ${{ needs.create-release.outputs.release_id }}