fix(community): bundle the desktop update signing key

[openai0229]

Problem

Community desktop verifies every release manifest with the Ed25519 key configured at packaging time, but that key never reached the packaged application. A packaged desktop therefore reported "no update" forever: TrustedUpdateKeys loaded no key and UpdateManifestVerifier rejected every manifest with Manifest signing key is not trusted (visible only in the update audit log).

Two independent causes, both confirmed on a real build:

1. chat2db-community-update-keys.properties was not part of the filtered resource set (the BOM filters only application*.properties/yml), so the -Dchat2db.community.update.* values passed by package-community-jcef.sh were never substituted.
2. Even with filtering enabled, the reactor inherits the Spring Boot @...@ delimiter configuration (resource.delimiter=@, useDefaultDelimiters=false), so the ${...} placeholders were not replaced either.

Nothing has been released with the updater yet, so there is no upgrade path to preserve.

Fix

• chat2db-community-jcef/pom.xml: filter the bundled key resource and enable the default ${...} delimiters for this module.
• script/package/package-community-jcef.sh: new verify_bundled_update_key fails packaging when a supplied key pair is absent from the built jcef jar; it stays quiet when no key is configured (local builds).
• script/package/desktop_layout.sh: drop the unreferenced chat2db_update_java_options helper, whose chat2db.update.* prefix does not match the runtime lookup (chat2db.community.update.*).

Verification

• mvn -o -pl :chat2db-community-jcef process-resources -Dchat2db.community.update.key-id=PROBE-KEY-ID -Dchat2db.community.update.public-key=PROBE-PUBLIC-KEY substitutes both values; the same command without -D keeps the placeholders (dev builds unchanged); the package output jar carries the substituted values.
• Real packaging script (SKIP_BACKEND=true SKIP_FRONTEND=true bash script/package/package-community-jcef.sh 5.3.0 prepare): no key -> [check] update signing key not supplied (exit 0); key supplied with an unsubstituted jar -> [error] bundled update signing key is not substituted (exit 1); substituted jar -> [check] bundled update signing key present (exit 0).
• bash -n on both scripts, script/package/tests/desktop-layout-test.sh passed, git diff --check clean.

Not run here: full reactor mvn clean install, native installers, and the release workflow itself (needs CI secrets and target platforms).