chore(release): v0.13.3 — updater elevation fix (+ install scope)

[jpicklyk]

Summary

Two commits: the 0.13.3 version bump, and a follow-up fix that the pre-release e2e uncovered.

The bump — five declarations via npm run version:bump 0.13.3; version:check agrees. Branched off main after #40.

90fdadd2 — tell the elevated installer which scope to install into. #40 made the updater elevate when an all-users install is updated by a non-elevated process. Driving that end to end on a real machine showed elevation alone is not enough: Tauri's NSIS template sets MULTIUSER_INSTALLMODE_DEFAULT_REGISTRY_KEY / …_VALUENAME "CurrentUser", so MultiUser picks its scope from that value and reads HKCU before HKLM. On a machine the original bug has already damaged — an all-users install plus the per-user copy an earlier update created — the per-user key wins and even an elevated installer updates the wrong one. MULTIUSER_INSTALLMODE_COMMANDLINE is defined, so passing /allusers overrides the default; it precedes /ARGS because everything after that is handed to the relaunched app.

Pre-release e2e (local, no release needed)

Test minisign keypair, a config overlay pointing the endpoint at http://127.0.0.1:8765, two signed NSIS builds (0.13.3 base, 0.13.4 update), a local server, and the base installed per-machine with admin credentials. Clicks dispatched as trusted Input.dispatchMouseEvent over CDP.

	Round 1 (elevation only)	Round 2 (/allusers)
HKLM (all-users)	0.13.3 — unchanged ✗	0.13.3 → 0.13.4 ✓
Program Files exe	0.13.3 ✗	0.13.4 ✓
HKCU (per-user decoy)	0.13.2 → 0.13.4 ✗	stays 0.13.3 ✓
Relaunched app owner	—	EMBER\jeff_, not the admin ✓

Round 2 was run with a per-user key deliberately planted, i.e. the exact condition that defeated round 1. Also verified along the way: needsElevation: true reported by get_app_update_policy, the Settings hint rendering before the click, the launch check and download hitting the local server, and the MCP sidecar relaunching alongside the app. Both test builds were uninstalled afterwards; the machine is back to no LogTapper keys.

• cargo test --lib app_update 13/13 (new: the scope switch must precede /ARGS)
• cargo clippy -- -D warnings clean
• Re-review of 90fdadd2 in flight

After merging

1. Tag v0.13.3 → release.yml builds the draft.
2. Publish the draft → publish-packages pushes 0.13.3 to the tap and bucket; the winget job stays soft-failing until microsoft/winget-pkgs#438639 merges.

🤖 Generated with Claude Code