CI: move vpk and Velopack to 1.2.161, whose Gitea upload survives the forge's new release responses

The desktop nightly has failed on every push to main since 2 October, at 'publish the nightly
release'. vpk 1.2.0 creates the draft release and then reads release.Assets from the forge's
answer, which the upgraded server (28.0.0) no longer fills in for a new release, so it threw a
NullReferenceException at GiteaRepository.cs:136. The step deletes the previous nightly-desktop
release before it uploads, so desktop clients have had no nightly to update from since.

1.2.161 reads the assets null-safely. The library moves with the tool, since Velopack expects the
two to match. Every vpk option the workflow and the release scripts pass is present in 1.2.161;
the only renamed ones are two MSI options nothing here uses.

.config/dotnet-tools.json

@@ -10,7 +10,7 @@
       "rollForward": false
     },
     "vpk": {
-      "version": "1.2.0",
+      "version": "1.2.161",
       "commands": [
         "vpk"
       ],

Directory.Packages.props

@@ -172,7 +172,7 @@
       constant rather than a setting: an operator who could answer the update check could pin a
       chosen user to a known-vulnerable build. See docs/adr/0013-desktop-distribution-and-updates.md.
     -->
-    <PackageVersion Include="Velopack" Version="1.2.0" />
+    <PackageVersion Include="Velopack" Version="1.2.161" />
 
     <!--
       Microsoft's own TPM 2.0 stack, TSS.MSR, and the only way LinuxDeviceKeyStore reaches the chip.

src/DodoSSH.Client.App/packages.lock.json

@@ -86,9 +86,9 @@
       },
       "Velopack": {
         "type": "Direct",
-        "requested": "[1.2.0, )",
+        "requested": "[1.2.161, )",
-        "resolved": "1.2.0",
+        "resolved": "1.2.161",
-        "contentHash": "Rz67gJL619fSBS6omaSINUxyDuwhIxkm5mmubf7uLd5Qgi6LLKaKCha+QFP6n+Bw/UjA0vutnH4JQfYzn6ANtw=="
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       },
       "Avalonia.Angle.Windows.Natives": {
         "type": "Transitive",

tests/DodoSSH.Client.App.Layout.Tests/packages.lock.json

@@ -491,7 +491,7 @@
           "DodoSSH.Client.Terminal": "[1.0.0, )",
           "DodoSSH.Client.Transfer": "[1.0.0, )",
           "Microsoft.TSS": "[2.1.1, )",
-          "Velopack": "[1.2.0, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "dodossh.client.api": {
@@ -788,9 +788,9 @@
       },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.0, )",
+        "requested": "[1.2.161, )",
-        "resolved": "1.2.0",
+        "resolved": "1.2.161",
-        "contentHash": "Rz67gJL619fSBS6omaSINUxyDuwhIxkm5mmubf7uLd5Qgi6LLKaKCha+QFP6n+Bw/UjA0vutnH4JQfYzn6ANtw=="
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }

tests/DodoSSH.Client.App.Tests/packages.lock.json

@@ -480,7 +480,7 @@
           "DodoSSH.Client.Terminal": "[1.0.0, )",
           "DodoSSH.Client.Transfer": "[1.0.0, )",
           "Microsoft.TSS": "[2.1.1, )",
-          "Velopack": "[1.2.0, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "dodossh.client.api": {
@@ -777,9 +777,9 @@
       },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.0, )",
+        "requested": "[1.2.161, )",
-        "resolved": "1.2.0",
+        "resolved": "1.2.161",
-        "contentHash": "Rz67gJL619fSBS6omaSINUxyDuwhIxkm5mmubf7uLd5Qgi6LLKaKCha+QFP6n+Bw/UjA0vutnH4JQfYzn6ANtw=="
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }