fix(kiosk): export WorkerMsg, import DecodePublicKey trait; CI master-push → dev

- WorkerMsg made pub + re-exported at crate root so local_server can send
  through the UI channel.
- ed25519_dalek::pkcs8::DecodePublicKey trait import — needed for
  VerifyingKey::from_public_key_pem call site.
- Workflow: pushes to master now auto-trigger a dev-channel build (in
  addition to tag-pushes for stable/beta). Concurrency group cancels
  superseded master builds; tag builds never cancel each other.

.github/workflows/release-kiosk.yml

@@ -15,6 +15,8 @@ name: release-kiosk
 
 on:
   push:
+    branches:
+      - master
     tags:
       - "v*"
   workflow_dispatch:
@@ -25,6 +27,12 @@ on:
         options: ["dev", "beta", "stable"]
         default: "dev"
 
+# Cancel an in-flight run when a newer commit lands on the same branch —
+# dev channel only needs the latest.
+concurrency:
+  group: release-kiosk-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+
 permissions:
   contents: write
 
@@ -68,11 +76,15 @@ jobs:
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             channel="${{ inputs.channel }}"
             version="0.0.0-dev.$(git rev-parse --short HEAD)"
-          else
+          elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
             tag="${GITHUB_REF#refs/tags/v}"
             version="$tag"
             if [[ "$tag" == *"-beta."* ]]; then channel="beta";
             else channel="stable"; fi
+          else
+            # Push to master → auto dev channel build.
+            channel="dev"
+            version="0.0.0-dev.$(git rev-parse --short HEAD)"
           fi
           echo "channel=$channel" >> "$GITHUB_OUTPUT"
           echo "version=$version" >> "$GITHUB_OUTPUT"

kiosk/src/firmware.rs

@@ -23,7 +23,7 @@ use std::path::PathBuf;
 use std::time::Duration;
 
 use base64::Engine as _;
-use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+use ed25519_dalek::{Signature, Verifier, VerifyingKey, pkcs8::DecodePublicKey};
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
 use tracing::{info, warn};

kiosk/src/main.rs

@@ -9,6 +9,8 @@ mod pipeline;
 mod ui;
 mod ws_client;
 
+pub use ui::WorkerMsg;
+
 pub enum ServerMsg {
     ReloadBundle,
     Standby,

kiosk/src/ui.rs

@@ -296,7 +296,7 @@ fn activate(app: &Application) {
     });
 }
 
-enum WorkerMsg {
+pub enum WorkerMsg {
     ShowPairingCode(String),
     RenderBundle(KioskBundle, String, String),
     SwitchLayout(u32),