Detect and install stable updates from inside the app

[thrr87]

What to build

Add an in-app updater for stable GitHub releases. When a newer signed release is available, show an Upgrade button between the existing refresh and settings buttons. The user must be able to review the version and release notes, confirm the update, and let the app download, verify, install, and relaunch itself.

The updater must use the signed stable feed produced by #65. It must not require an Apple Developer ID certificate, automatically download updates, show system notifications, or permanently skip a version.

Acceptance criteria

• The app checks the signed stable update feed at launch and no more than once every six hours while running.
• Only a newer published stable release is offered; drafts, prereleases, older versions, and invalidly signed feed entries are ignored.
• An Upgrade button appears between refresh and settings only when a newer version is available and has an accessible label and tooltip.
• Clicking Upgrade shows the new version and release notes and requires explicit confirmation before downloading.
• Closing or declining the confirmation keeps the Upgrade button visible while that release remains available; there is no permanent skip action.
• Confirming downloads and cryptographically verifies the update before installation, replaces the app safely, and relaunches the updated version.
• Download, verification, extraction, or installation failure leaves the currently installed app working and presents a clear retryable error.
• The app does not download updates in the background and does not send a macOS notification about availability.
• Update progress and failure states remain usable with keyboard navigation and assistive technologies.
• A local signed-feed QA path can force the available-update state and run an end-to-end older-to-newer update without publishing a public release.
• Documentation explains that, without Apple Developer ID signing and notarization, first installation remains subject to macOS Gatekeeper behavior even though signed in-app updates are verified independently.

Blocked by

#65

[thrr87]

Implemented and exercised end-to-end in #64 (a208d5e).

• The accessible Upgrade button appears between Refresh and Settings only when a newer stable release is available.
• Sparkle shows version and release notes, requires confirmation, verifies both the appcast and archive with EdDSA, installs, and relaunches.
• Closing the dialog leaves the Upgrade button available; the signed feed marks updates critical so there is no permanent Skip action.
• Final Computer Use QA updated a separate local app from 0.2.6/build 7 to 0.2.7/build 8. After relaunch the app remained usable and the Upgrade button disappeared.
• 564 Swift tests pass, and no public release was required for the QA flow.

The issue can close when #64 merges.