raco rivet release: let products choose the update payload (installer kind + file) #244

raco rivet release's built-in update manifest assumes the zip is the update payload. syncpilot (tar.gz is the artifact for its Linux-only distribution) is forced into release --without-updates plus a ~60-line hand-rolled signed-manifest heredoc in release.yml:114-131 and scripts/make-update-manifest.sh. taskly's AppImage legs hit the same seam.

Proposal: raco rivet release --update-payload <installer-kind>:<glob> (repeatable), so the generated manifest points at whichever artifact is the update payload per platform. This deletes one private signer per product and keeps the release pipeline the single place that knows how to produce feeds.

Related: #242's sign-manifest subcommand would absorb syncpilot's remaining hand-rolled assembly.