Actually offer a preview the release it precedes, and fix two more gaps

An Opus review of the previous commit found its headline claim didn't
hold: a preview and the release it precedes compute to the identical
numeric version by construction, but check_for_updates compared with a
strict `>` against the bare CARGO_PKG_VERSION (never the suffixed display
string), so `(0,4,13) > (0,4,13)` is false and the release was never
offered. Plain semver ordering doesn't make a `-preview.<sha>` suffix sort
below the same numeric release on its own here, since the comparison
never sees the suffix at all.

pick_update now takes is_preview_build, derived from whether
TRIPLE_C_BUILD_SUFFIX was baked in, and relaxes that one comparison to
`>=` — so "a release exists at my own number" reads as an update. A
production build still requires strictly newer.

Also: ported build-app.yml's `git tag --points-at HEAD` guard into the
preview version computation. Without it, workflow_dispatch (which this
workflow allows on main, not just PR builds) run on a commit a release
was already cut from would compute one past that release — reintroducing
"preview outranks production" through the manual-dispatch door. And
corrected two comments that claimed the prerelease filter was currently a
no-op: backfill-releases.yml mirrors every Gitea release to GitHub
unfiltered, prerelease flag included, so it's real defence-in-depth
against a dispatched backfill leaking a preview release, not a no-op.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGjXq6fqtAFHdbhk4f3PfZ

app/src-tauri/src/models/update_info.rs

@@ -29,10 +29,18 @@ pub struct GitHubRelease {
     /// Whether GitHub itself has this release marked as a prerelease.
     /// `#[serde(default)]` rather than required: every response GitHub sends
     /// carries this, but nothing here should refuse to parse the rest of a
-    /// release over one missing field. No production release is ever
-    /// mirrored with this `true` today — see `check_for_updates`, which
-    /// filters on it explicitly rather than relying on that being an
-    /// accident of what happens to get mirrored.
+    /// release over one missing field. Defaults to `false` (offered) rather
+    /// than `true` (excluded) — a missing field only happens if GitHub's API
+    /// shape changes, and "API changed, therefore updates silently stop
+    /// working forever" is the worse failure of the two.
+    ///
+    /// `build-app.yml`'s own mirror never publishes a prerelease, but
+    /// `.gitea/workflows/backfill-releases.yml` forwards every Gitea release
+    /// unfiltered, `prerelease` included — so if it were ever dispatched
+    /// while a preview release existed, this field is what stops
+    /// `check_for_updates` from offering it (the `preview-<sha>` tag shape
+    /// already fails semver parsing independently, but this is real
+    /// defence-in-depth, not a no-op).
     #[serde(default)]
     pub prerelease: bool,
 }