Release: sign SHA256SUMS.txt with the release key; docs/updates.md (#231)

The release job signs SHA256SUMS.txt into SHA256SUMS.txt.minisig with rsign2 when the
FIELDCRAFT_SIGNING_KEY secret exists, and checks the signature against the public key the app
is built with; without the secret the draft is unsigned, the run warns and the notes say the
app cannot install that release itself. docs/releasing.md says how the key is set up, kept
and rotated; docs/updates.md describes checking, verifying and installing, the web app's
Reload to update, and FIELDCRAFT_UPDATE_HOST for tests. privacy.md, control-protocol.md,
web.md and the roadmap say what changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

docs/privacy.md

@@ -11,6 +11,12 @@ Change it any time in **Help › Settings… › Privacy**, which also has **Inc
 agents (MCP)**: commands run by scripts, the control channel and AI agents are counted apart from
 yours (`from`), and this leaves them out.
 
+Checking for updates is separate from usage sharing: at start-up, at most once a day (and from
+Help › Check for Updates), the desktop app asks GitHub for the latest release, which sends the
+request itself (FieldCraft's version in the `User-Agent`; GitHub sees the IP address) and nothing
+else. Turn it off in **Help › Settings… › Updates** (or with the first run's question): then no
+request is made ([updates.md](updates.md)).
+
 Crash reports and the log never leave your computer on their own; Help › Report a Bug sends only
 what you submit yourself ([crash-reports.md](crash-reports.md)).