feat(delivery): harden manager self-update and prepare SignPath migration

[Wangnov]

Summary

• 完成 Manager 自更新的静默检查、Home/About 共用状态、真实进度、稍后提醒、失败恢复与安装后 handoff。
• 以签名根身份绑定稳定版本、release notes、平台、artifact basename 与 SHA-256；镜像失败时安全回退 GitHub。
• 为 manifest 与 artifact 分离超时，限制响应体大小，保留 immutable rerun 已发布签名的原始字节。
• 将 relaunch 收口到 Rust 后端共享 operation lock，移除 renderer 的 process/updater capability；破坏性 token 绑定精确操作类型、单次认领，renderer 只能取消尚未认领的 token。
• Windows Authenticode 改为 SignPath Foundation 迁移占位和 fail-closed 门禁；当前尚未获得证书，也没有声称 release 已可用。

Validation

• npm run check / npm run lint / npm run build — pass
• npm test — pass（27 files / 255 tests）
• npm run test:release — pass（73/73）
• cargo test --locked --manifest-path src-tauri/Cargo.toml --lib — pass（126/126）
• Vendored updater tests — pass（10/10）
• macOS engine tests — pass（27 total）；Windows engine tests — pass（72）
• git diff --check — pass
• Independent review agents — no P1/P2 findings
• Exact codex review --uncommitted — 未发现由当前改动引入的明确功能缺陷
• Final exact codex review --base codex/issue-170-mirror-monotonic-promotion — 未发现需修复的 P1/P2 正确性或回归问题
• GitHub PR checks — pass（6/6）for head 86906cc

External rollout gates

本 PR 保持 Draft，以下事项尚未完成：

• 你需要复核 SignPath Foundation 表单中的个人/法律信息并亲自提交；之后等待 Foundation 审批并取得 organization/project/policy IDs。
• fix(release): prevent latest mirror downgrade and verify both backends #176 合并后按新的 release environment policy 重新录入 Apple/Tauri signing secrets，并完成旧 credential 清理。
• 部署 manager download Worker；GitHub Immutable Releases 最后单独启用。
• 在上述外部门禁完成前，Windows tag job 会按设计 fail closed，不会发布未签名或仅 macOS 的不完整 Release。

Refs #171

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86906cc534

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Strip the workflow_run @ref suffix

For the tag-signalled release path, GitHub populates workflow_run.path with the workflow file plus the ref suffix (for example .github/workflows/build.yml@main in the documented workflow-run object), so this equality against the bare filename rejects every completed Release source run before any credentialed release jobs start. Strip the @... suffix, or compare against the suffixed form, before failing preflight.

Useful? React with 👍 / 👎.