fix(release): 修正 updater 清单的下载 URL 与发布顺序

发布时 verify update manifest 失败：draft release 的资产 URL 为
`.../releases/download/untagged-<hash>/...`，而校验要求 URL 含 tag 名。

- create-update-manifest.mjs 不再依赖 draft release 的
  browser_download_url，改为按 tag 与资产名自行拼接稳定的
  `.../releases/download/<tag>/<name>` 地址。
- build-on-tag.yml 将 Publish release 提前到生成/校验清单之前，
  使清单在 release 已发布后生成；并移除多余的
  “Refresh published GitHub release metadata” 步骤。
- catalog.ts 版本公告更新为 1.0.0-beta13。

.github/workflows/build-on-tag.yml

@@ -303,6 +303,20 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release download "${GITHUB_REF_NAME}" --pattern '*.sig' --dir release-check/signatures
 
+      # Publish the draft release before generating the updater manifest. While
+      # the release is a draft GitHub reports asset URLs as
+      # `.../releases/download/untagged-<hash>/...`; only after publishing does
+      # the manifest point at the stable `.../releases/download/<tag>/...` path.
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
+          else
+            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
+          fi
+
       - name: Download release metadata
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -329,31 +343,6 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release upload "${GITHUB_REF_NAME}" release-check/latest.json --clobber
 
-      - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [[ "${GITHUB_REF_NAME}" == *-* ]]; then
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --prerelease
-          else
-            gh release edit "${GITHUB_REF_NAME}" --draft=false --latest
-          fi
-
-      - name: Refresh published GitHub release metadata
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_id="$(
-            gh api "repos/${GITHUB_REPOSITORY}/releases" \
-              --paginate \
-              --jq ".[] | select(.tag_name == \"${GITHUB_REF_NAME}\") | .id"
-          )"
-          if [[ -z "$release_id" ]]; then
-            echo "Published release ${GITHUB_REF_NAME} was not found"
-            exit 1
-          fi
-          gh api "repos/${GITHUB_REPOSITORY}/releases/${release_id}" > release-check/release.json
-
       - name: Build Update Server artifact catalog
         run: |
           node scripts/axolotl/create-update-server-catalog.mjs \

apps/app-frontend/src/announcements/catalog.ts

@@ -33,12 +33,12 @@ export const ANNOUNCEMENT_CHANGE_TYPES: readonly AnnouncementChangeType[] = [
 
 export const launcherAnnouncements: readonly LauncherAnnouncement[] = [
 	{
-		id: 'launcher-1.0.0-beta12',
-		version: '1.0.0-beta12',
-		publishedAt: '2026-09-25',
+		id: 'launcher-1.0.0-beta13',
+		version: '1.0.0-beta13',
+		publishedAt: '2026-09-26',
 		title: {
-			'en-US': 'Starlight Launcher 1.0.0-beta12',
-			'zh-CN': 'Starlight Launcher 1.0.0-beta12',
+			'en-US': 'Starlight Launcher 1.0.0-beta13',
+			'zh-CN': 'Starlight Launcher 1.0.0-beta13',
 		},
 		changes: {
 			added: [

scripts/axolotl/create-update-manifest.mjs

@@ -1,6 +1,15 @@
 import fs from 'node:fs'
 import path from 'node:path'
 
+// Build a stable release download URL from the tag and asset name instead of
+// relying on `browser_download_url`. While the release is still a draft GitHub
+// reports the asset URL as `.../releases/download/untagged-<hash>/...`, which
+// would make the updater manifest point at a path that disappears once the
+// release is published.
+function buildDownloadUrl(assetName, versionTag) {
+	const repository = process.env.GITHUB_REPOSITORY || 'ApTx2012/Starlight_Lancher'
+	return `https://github.com/${repository}/releases/download/${versionTag}/${encodeURIComponent(assetName)}`
+}
 const [releasePath, signaturesPath, tag, outputPath] = process.argv.slice(2)
 
 if (!releasePath || !signaturesPath || !tag || !outputPath) {
@@ -52,10 +61,7 @@ for (const target of targets) {
 	}
 
 	const signature = fs.readFileSync(signaturePath, 'utf8')
-	const url = asset.browser_download_url ?? asset.url
-	if (!url) {
-		throw new Error(`Release asset ${asset.name} does not contain a download URL`)
-	}
+	const url = buildDownloadUrl(asset.name, tag)
 
 	for (const platform of target.platforms) {
 		platforms[platform] = { signature, url }
@@ -81,8 +87,8 @@ for (const target of [
 		)
 	}
 	const asset = matches[0]
-	const url = asset.browser_download_url ?? asset.url
-	if (!url || !Number.isSafeInteger(asset.size) || asset.size <= 0) {
+	const url = buildDownloadUrl(asset.name, tag)
+	if (!Number.isSafeInteger(asset.size) || asset.size <= 0) {
 		throw new Error(`Release asset ${asset.name} has invalid download metadata`)
 	}
 	apt[target.platform] = {