Fix installer manifest public key injection (#5537)

The manifest public key wasn't being injected properly because:
1. Workspace status variables need STABLE_ prefix for x_defs stamping
2. BUILD.bazel was using {MANIFEST_PUBLIC_KEY} but the variable
   wasn't being output with the STABLE_ prefix

This caused the installer to try to base64 decode the literal string
"{MANIFEST_PUBLIC_KEY}" instead of the actual public key value.

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

src/main/go/net/eagle0/clients/win/installer/BUILD.bazel

@@ -34,7 +34,7 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
     x_defs = {
-        "main.manifestPublicKey": "{MANIFEST_PUBLIC_KEY}",
+        "main.manifestPublicKey": "{STABLE_MANIFEST_PUBLIC_KEY}",
     },
 )
 
@@ -164,7 +164,7 @@ GOSUM
         echo "Building Windows installer with WebView..."
         OUTPUT_EXE="$$SANDBOX_ROOT/$@"
         $$GO build -v \\
-            -ldflags="-H windowsgui -X main.manifestPublicKey={MANIFEST_PUBLIC_KEY}" \\
+            -ldflags="-H windowsgui -X main.manifestPublicKey={STABLE_MANIFEST_PUBLIC_KEY}" \\
             -o "$$OUTPUT_EXE" \\
             .
 
@@ -181,6 +181,6 @@ go_binary(
     pure = "on",
     visibility = ["//visibility:public"],
     x_defs = {
-        "main.manifestPublicKey": "{MANIFEST_PUBLIC_KEY}",
+        "main.manifestPublicKey": "{STABLE_MANIFEST_PUBLIC_KEY}",
     },
 )

tools/workspace_status.sh

@@ -11,9 +11,10 @@ BUILD_TIME=$(date -u '+%Y-%m-%d %H:%M UTC')
 echo "BUILD_TIMESTAMP ${BUILD_TIME}"
 
 # Manifest public key for installer signature verification (from environment)
+# Must use STABLE_ prefix for x_defs stamping to work
 # Empty string means signature verification will be skipped
 if [ -n "$MANIFEST_PUBLIC_KEY" ]; then
-    echo "MANIFEST_PUBLIC_KEY ${MANIFEST_PUBLIC_KEY}"
+    echo "STABLE_MANIFEST_PUBLIC_KEY ${MANIFEST_PUBLIC_KEY}"
 else
-    echo "MANIFEST_PUBLIC_KEY "
+    echo "STABLE_MANIFEST_PUBLIC_KEY "
 fi