fix(updater): embed full release changelog in updater manifest

[quiet-node]

Problem

The in-app "A new version of Thuki is available!" window showed only a bare link
(https://github.com/quiet-node/thuki/releases/tag/vX.Y.Z) under RELEASE NOTES
instead of the actual changelog.

Root cause is entirely in CI. The "Generate updater manifest" step in
release-please.yml hardcoded:

"notes": "https://github.com/quiet-node/thuki/releases/tag/${TAG}"

The Tauri updater surfaces the manifest notes field as update.body, and
UpdateWindow.tsx renders body as markdown. Frontend and backend were already
correct: they faithfully rendered the URL string they were given.

Fix

In the Generate updater manifest step:

• Fetch the real release-please changelog for the tag via
  gh release view "$TAG" --json body --jq .body.
• Build latest.json with jq --rawfile instead of a heredoc, so newlines,
  quotes, backticks and $ in the changelog stay JSON-safe (the old heredoc
  interpolation could not handle these).
• Fail the job loudly if the release body is empty. release-please always
  creates the release with a non-empty body before this job runs, so a blank
  body indicates upstream breakage and should not silently ship an empty
  manifest. No URL fallback is written: the frontend already has a graceful
  "View them on GitHub" fallback when body is empty.
• Add GITHUB_TOKEN to the step so gh is authenticated.

No application code changes: the frontend/backend already render body as
markdown.

Verification

Local validation (a YAML-only CI change is not exercised by the test suite):

• Workflow YAML parses.
• jq output is valid JSON.
• An adversarial changelog body (double quotes, backticks, $, &,
  apostrophes, multi-line) round-trips byte-identical through the manifest.
• The empty-body guard exits non-zero as intended.

Scope note

This is forward-only for the build pipeline. v0.11.2's already-published
latest.json was regenerated and re-uploaded separately (signature/url/pub_date
unchanged, only notes replaced) so existing users on 0.11.1 see real notes for
the 0.11.2 prompt.