优化: 换装脚本本地模式适配与版本号

- 未设签名私钥时自动关 updater 产物, 免 tauri build 中断
- 发版(需签名)分流 publish-release.ps1, 本地换装/正式发布分离

scripts/publish-release.ps1

@@ -81,7 +81,12 @@ if (-not $Notes) {
     if (-not $Notes) { $Notes = "DevFlow v$version" }
 }
 $pubDate = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
-$sha256 = (Get-FileHash $artifact.FullName -Algorithm SHA256).Hash.ToLower()
+# SHA256:本机 PowerShell 5.1 实测缺 Get-FileHash(同 swap-install 兜底口径),异常走 certutil
+function Get-Sha256Lower($path) {
+    try { return (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower() }
+    catch { return (((certutil -hashfile $path SHA256) | Select-Object -Index 1) -replace '\s', '').ToLower() }
+}
+$sha256 = Get-Sha256Lower $artifact.FullName
 $latestJson = [ordered]@{
     version   = $version
     notes     = $Notes
@@ -94,7 +99,10 @@ $latestJson = [ordered]@{
     }
 } | ConvertTo-Json -Depth 5
 $latestPath = "$repo\target\release\bundle\nsis\latest.json"
-$latestJson | Out-File $latestPath -Encoding utf8 -NoNewline
+# ⚠️ 必须写「UTF-8 无 BOM」:Windows PowerShell 5.1 的 `Out-File -Encoding utf8` 会写 BOM
+# (EF BB BF),部分 JSON 解析路径会报 "expected value at line 1 column 1",
+# 表现为 updater 拿到清单即失败(签名/包都没错,只多了头 3 字节)。2026-10-10 实证修正。
+[System.IO.File]::WriteAllText($latestPath, $latestJson, (New-Object System.Text.UTF8Encoding($false)))
 Write-Host "       latest.json: version=$version, sha256=$($sha256.Substring(0,16))..."
 
 # ── 5. 上传到 app.1216.top ──