fix: disable updater signing in artifacts workflow, widen PR paths

The artifacts workflow has no signing keys, so Tauri exits non-zero
when createUpdaterArtifacts is enabled. Pass --config to disable it
for artifact builds (same approach as the Makefile local targets).

Also widen the pull_request paths filter to cover all desktop build
inputs: frontend/, cmd/, internal/, go.mod/go.sum, and the desktop
workflow files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: wesm

.github/workflows/desktop-artifacts.yml

@@ -5,8 +5,12 @@ on:
   pull_request:
     paths:
       - 'desktop/**'
-      - '.github/workflows/desktop-artifacts.yml'
-      - '.github/workflows/desktop-release.yml'
+      - 'frontend/**'
+      - 'cmd/**'
+      - 'internal/**'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/desktop-*.yml'
 
 permissions:
   contents: read
@@ -82,7 +86,8 @@ jobs:
         run: |
           cd desktop
           npm run prepare-sidecar
-          npx tauri build --bundles "${{ matrix.bundle }}"
+          npx tauri build --bundles "${{ matrix.bundle }}" \
+            --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
       - name: Desktop smoke tests (Rust unit tests)
         shell: bash