fix(updater): macOS in-place update can quit the app and leave a broken bundle #1587

Problem

buildMacAppReplaceScript (lib/core/updater/installers/update_install_utils.dart) and MacosSparkleInstaller.install can quit the app without installing anything, or corrupt the bundle.

• mv "$TARGET" "$TARGET.old" || true swallows failures. When the move fails (no write access to /Applications, read-only DMG volume, App Translocation after running from Downloads), cp -R "$NEW" "$TARGET" copies into the existing bundle: a nested .app, a broken seal, "damaged" from Gatekeeper.
• With set -e, a failing cp after a successful mv aborts the script and leaves no app at $TARGET. There is no rollback from .old.
• MacosSparkleInstaller calls exit(0) right after starting the script and never checks its result, so the user just sees the app close.
• $TARGET.old is not removed on success; the extracted querya-update-* temp directory is never cleaned.

Expected

Check before exiting that the target's parent is writable and the bundle is not translocated / on a read-only volume; if not, tell the user (and offer the download). Replace atomically with rollback from .old, remove .old on success, clean the temp dir, and report a script failure on next start.

Tasks

• Pre-flight writable / translocation / read-only check before exit(0).
• Remove || true, add rollback, remove .old.
• Clean the extract dir.
• Unit tests for the script builder (quoting, failure paths).